# CVEs published 2013-10-25 19 CVEs were published on October 25, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-1067](https://cve.now/CVE-2013-1067.md): Apport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries, which allows local users to obtain sensitive (no CVSS) - [CVE-2013-4421](https://cve.now/CVE-2013-4421.md): The buf\_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory c (no CVSS) - [CVE-2013-4434](https://cve.now/CVE-2013-4434.md): Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the u (no CVSS) - [CVE-2013-4465](https://cve.now/CVE-2013-4465.md): Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authen (no CVSS) - [CVE-2013-4957](https://cve.now/CVE-2013-4957.md): The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type. (no CVSS) - [CVE-2013-4965](https://cve.now/CVE-2013-4965.md): Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier (no CVSS) - [CVE-2013-6283](https://cve.now/CVE-2013-6283.md): VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code (no CVSS) - [CVE-2013-3989](https://cve.now/CVE-2013-3989.md): IBM Security AppScan Enterprise 8.x before 8.8 sends a cleartext AppScan Source database password in a response, which allows remote authent (no CVSS) - [CVE-2013-5424](https://cve.now/CVE-2013-5424.md): IBM Flex System Manager (FSM) 1.3.0 allows remote attackers to bypass intended access restrictions, and create new user accounts or execute (no CVSS) - [CVE-2013-6127](https://cve.now/CVE-2013-6127.md): The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly re (no CVSS) - [CVE-2013-6128](https://cve.now/CVE-2013-6128.md): The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restr (no CVSS) - [CVE-2013-6280](https://cve.now/CVE-2013-6280.md): Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbit (no CVSS) - [CVE-2013-6281](https://cve.now/CVE-2013-6281.md): Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows (no CVSS) - [CVE-2013-3280](https://cve.now/CVE-2013-3280.md): EMC RSA Authentication Agent 7.1.x before 7.1.2 for Web for Internet Information Services has a fail-open design, which allows remote attack (no CVSS) - [CVE-2013-5521](https://cve.now/CVE-2013-5521.md): Cisco Identity Services Engine does not properly restrict the creation of guest accounts, which allows remote attackers to cause a denial of (no CVSS) - [CVE-2013-5522](https://cve.now/CVE-2013-5522.md): Cisco IOS on Catalyst 3750X switches has default Service Module credentials, which makes it easier for local users to gain privileges via a (no CVSS) - [CVE-2013-5530](https://cve.now/CVE-2013-5530.md): The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145 (no CVSS) - [CVE-2013-5531](https://cve.now/CVE-2013-5531.md): Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuratio (no CVSS) - [CVE-2013-5549](https://cve.now/CVE-2013-5549.md): Cisco IOS XR 3.8.1 through 4.2.0 does not properly process fragmented packets within the RP-A, RP-B, PRP, and DRP-B route-processor componen (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-10-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.