# CVEs published 2013-10-24

52 CVEs were published on October 24, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1733](https://cve.now/CVE-2013-1733.md): Cross-site request forgery (CSRF) vulnerability in process\_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the auth (no CVSS)
- [CVE-2013-1734](https://cve.now/CVE-2013-1734.md): Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2. (no CVSS)
- [CVE-2013-1742](https://cve.now/CVE-2013-1742.md): Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x befo (no CVSS)
- [CVE-2013-1743](https://cve.now/CVE-2013-1743.md): Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 (no CVSS)
- [CVE-2013-4299](https://cve.now/CVE-2013-4299.md): Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain se (no CVSS)
- [CVE-2013-5130](https://cve.now/CVE-2013-5130.md): WebKit in Apple Safari before 6.1 disables the Private Browsing feature upon a launch of the Web Inspector, which makes it easier for contex (no CVSS)
- [CVE-2013-5143](https://cve.now/CVE-2013-5143.md): The RADIUS service in Server App in Apple OS X Server before 3.0 selects a fallback X.509 certificate in unspecified circumstances, which mi (no CVSS)
- [CVE-2013-5148](https://cve.now/CVE-2013-5148.md): Apple Keynote before 6.0 does not properly handle the interaction between Keynote presentation mode and the Screen Lock implementation, whic (no CVSS)
- [CVE-2013-5536](https://cve.now/CVE-2013-5536.md): Cisco Secure Access Control System (ACS) does not properly implement an incoming-packet firewall rule, which allows remote attackers to caus (no CVSS)
- [CVE-2013-5537](https://cve.now/CVE-2013-5537.md): The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) dev (no CVSS)
- [CVE-2013-2236](https://cve.now/CVE-2013-2236.md): Stack-based buffer overflow in the new\_msg\_lsa\_change\_notify function in the OSPFD API (ospf\_api.c) in Quagga before 0.99.22.2, when --enabl (no CVSS)
- [CVE-2013-4293](https://cve.now/CVE-2013-4293.md): The server in Red Hat JBoss Operations Network (JON) 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive informa (no CVSS)
- [CVE-2013-4295](https://cve.now/CVE-2013-4295.md): The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing a (no CVSS, org.apache.shindig:shindig-php)
- [CVE-2013-4373](https://cve.now/CVE-2013-4373.md): The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files (no CVSS)
- [CVE-2013-4390](https://cve.now/CVE-2013-4390.md): Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Ap (no CVSS, org.apache.sling:org.apache.sling.auth.core)
- [CVE-2013-5135](https://cve.now/CVE-2013-5135.md): Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple Remote Desktop before 3.5.4 allows remote attac (no CVSS)
- [CVE-2013-5136](https://cve.now/CVE-2013-5136.md): Apple Remote Desktop before 3.7 does not properly use server authentication-type information during decisions about whether to present an un (no CVSS)
- [CVE-2013-5144](https://cve.now/CVE-2013-5144.md): Passcode Lock in Apple iOS before 7.0.3 on iPhone devices allows physically proximate attackers to bypass an intended passcode requirement, (no CVSS)
- [CVE-2013-5162](https://cve.now/CVE-2013-5162.md): Passcode Lock in Apple iOS before 7.0.3 on iPhone devices allows physically proximate attackers to bypass the passcode-failure disabled stat (no CVSS)
- [CVE-2013-5164](https://cve.now/CVE-2013-5164.md): Multiple race conditions in the Phone app in Apple iOS before 7.0.3 allow physically proximate attackers to bypass the locked state, and dia (no CVSS)
- [CVE-2013-5165](https://cve.now/CVE-2013-5165.md): socketfilterfw in Application Firewall in Apple Mac OS X before 10.9 does not properly implement the --blockApp option, which allows remote (no CVSS)
- [CVE-2013-5166](https://cve.now/CVE-2013-5166.md): The Bluetooth USB host controller in Apple Mac OS X before 10.9 prematurely deletes interfaces, which allows local users to cause a denial o (no CVSS)
- [CVE-2013-5167](https://cve.now/CVE-2013-5167.md): CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, whi (no CVSS)
- [CVE-2013-5168](https://cve.now/CVE-2013-5168.md): Console in Apple Mac OS X before 10.9 allows user-assisted remote attackers to execute arbitrary applications by triggering a log entry with (no CVSS)
- [CVE-2013-5169](https://cve.now/CVE-2013-5169.md): CoreGraphics in Apple Mac OS X before 10.9, when display-sleep mode is used, does not ensure that screen locking blocks the visibility of al (no CVSS)
- [CVE-2013-5170](https://cve.now/CVE-2013-5170.md): Buffer underflow in CoreGraphics in Apple Mac OS X before 10.9 allows remote attackers to execute arbitrary code or cause a denial of servic (no CVSS)
- [CVE-2013-5171](https://cve.now/CVE-2013-5171.md): CoreGraphics in Apple Mac OS X before 10.9 allows local users to bypass secure input mode and log an arbitrary application's keystrokes via (no CVSS)
- [CVE-2013-5172](https://cve.now/CVE-2013-5172.md): The kernel in Apple Mac OS X before 10.9 does not properly determine the output length for SHA-2 digest function calls, which allows context (no CVSS)
- [CVE-2013-5173](https://cve.now/CVE-2013-5173.md): The random-number generator in the kernel in Apple Mac OS X before 10.9 provides lengthy exclusive access for processing of large requests, (no CVSS)
- [CVE-2013-5174](https://cve.now/CVE-2013-5174.md): Integer signedness error in the kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a cr (no CVSS)
- [CVE-2013-5175](https://cve.now/CVE-2013-5175.md): The kernel in Apple Mac OS X before 10.9 allows local users to obtain sensitive information or cause a denial of service (out-of-bounds read (no CVSS)
- [CVE-2013-5176](https://cve.now/CVE-2013-5176.md): The kernel in Apple Mac OS X before 10.9 does not properly handle integer values during unspecified tty device operations, which allows loca (no CVSS)
- [CVE-2013-5177](https://cve.now/CVE-2013-5177.md): The kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service (panic) via an invalid iovec structure. (no CVSS)
- [CVE-2013-5178](https://cve.now/CVE-2013-5178.md): LaunchServices in Apple Mac OS X before 10.9 does not properly restrict Unicode characters in filenames, which allows context-dependent atta (no CVSS)
- [CVE-2013-5179](https://cve.now/CVE-2013-5179.md): App Sandbox in Apple Mac OS X before 10.9 allows attackers to bypass intended sandbox restrictions via a crafted app that uses the LaunchSer (no CVSS)
- [CVE-2013-5180](https://cve.now/CVE-2013-5180.md): The srandomdev function in Libc in Apple Mac OS X before 10.9, when the kernel random-number generator is unavailable, produces predictable (no CVSS)
- [CVE-2013-5181](https://cve.now/CVE-2013-5181.md): The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support C (no CVSS)
- [CVE-2013-5182](https://cve.now/CVE-2013-5182.md): Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message by usin (no CVSS)
- [CVE-2013-5183](https://cve.now/CVE-2013-5183.md): Mail in Apple Mac OS X before 10.9, when Kerberos authentication is enabled and TLS is disabled, sends invalid cleartext data, which allows (no CVSS)
- [CVE-2013-5184](https://cve.now/CVE-2013-5184.md): The kernel in Apple Mac OS X before 10.9 does not properly check for errors during the processing of multicast Wi-Fi packets, which allows r (no CVSS)
- [CVE-2013-5185](https://cve.now/CVE-2013-5185.md): The ldapsearch command-line program in OpenLDAP in Apple Mac OS X before 10.9 does not properly process the minssf configuration setting, wh (no CVSS)
- [CVE-2013-5186](https://cve.now/CVE-2013-5186.md): Power Management in Apple Mac OS X before 10.9 does not properly handle the interaction between locking and power assertions, which allows p (no CVSS)
- [CVE-2013-5187](https://cve.now/CVE-2013-5187.md): The Screen Lock implementation in Apple Mac OS X before 10.9 does not immediately accept Keychain Status menu Lock Screen commands, and inst (no CVSS)
- [CVE-2013-5188](https://cve.now/CVE-2013-5188.md): The Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are enabled, does not require a password for a (no CVSS)
- [CVE-2013-5189](https://cve.now/CVE-2013-5189.md): Apple Mac OS X before 10.9 does not preserve a certain administrative system-preferences setting across software updates, which allows conte (no CVSS)
- [CVE-2013-5190](https://cve.now/CVE-2013-5190.md): Smart Card Services in Apple Mac OS X before 10.9 does not properly implement certificate-revocation checks, which allows remote attackers t (no CVSS)
- [CVE-2013-5191](https://cve.now/CVE-2013-5191.md): The syslog implementation in Apple Mac OS X before 10.9 allows local users to obtain sensitive information by leveraging access to the Guest (no CVSS)
- [CVE-2013-5192](https://cve.now/CVE-2013-5192.md): The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a request with a cra (no CVSS)
- [CVE-2013-6246](https://cve.now/CVE-2013-6246.md): The Dell Quest One Password Manager, possibly 5.0, allows remote attackers to bypass CAPTCHA protections and obtain sensitive information (u (no CVSS)
- [CVE-2013-3244](https://cve.now/CVE-2013-3244.md): Multiple unspecified vulnerabilities in the CJDB\_FILL\_MEMORY\_FROM\_PPB function in the Project System (PS-IS) module for SAP ERP Central Comp (no CVSS)
- [CVE-2013-6244](https://cve.now/CVE-2013-6244.md): The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui\_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attac (no CVSS)
- [CVE-2013-6245](https://cve.now/CVE-2013-6245.md): Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.