# CVEs published 2013-10-28

28 CVEs were published on October 28, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2010-1159](https://cve.now/CVE-2010-1159.md): Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbit (no CVSS)
- [CVE-2012-0825](https://cve.now/CVE-2012-0825.md): Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers (no CVSS)
- [CVE-2012-0826](https://cve.now/CVE-2012-0826.md): Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attacke (no CVSS)
- [CVE-2012-0827](https://cve.now/CVE-2012-0827.md): The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary (no CVSS)
- [CVE-2012-6303](https://cve.now/CVE-2012-6303.md): Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, (no CVSS)
- [CVE-2013-2208](https://cve.now/CVE-2013-2208.md): tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file. (no CVSS)
- [CVE-2013-3243](https://cve.now/CVE-2013-3243.md): Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors. (no CVSS)
- [CVE-2013-3704](https://cve.now/CVE-2013-3704.md): The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a r (no CVSS)
- [CVE-2013-4391](https://cve.now/CVE-2013-4391.md): Integer overflow in the valid\_user\_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2013-4392](https://cve.now/CVE-2013-4392.md): systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via (CVSS 5.0)
- [CVE-2013-4393](https://cve.now/CVE-2013-4393.md): journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blo (no CVSS)
- [CVE-2013-4394](https://cve.now/CVE-2013-4394.md): The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Exte (no CVSS)
- [CVE-2013-4402](https://cve.now/CVE-2013-4402.md): The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infi (no CVSS)
- [CVE-2013-5744](https://cve.now/CVE-2013-5744.md): Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-6012](https://cve.now/CVE-2013-6012.md): Juniper Junos 12.1X44 before 12.1.X44-D20 and 12.1X45 before 12.1X45-D15, when the no-validate option is enabled, does not properly handle c (no CVSS)
- [CVE-2013-6014](https://cve.now/CVE-2013-6014.md): Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 be (no CVSS)
- [CVE-2013-6288](https://cve.now/CVE-2013-6288.md): Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors, (no CVSS, apache-solr-for-typo3/solr)
- [CVE-2013-6289](https://cve.now/CVE-2013-6289.md): Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to inj (no CVSS, apache-solr-for-typo3/solr)
- [CVE-2012-4529](https://cve.now/CVE-2012-4529.md): The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, (no CVSS)
- [CVE-2012-4572](https://cve.now/CVE-2012-4572.md): Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom (no CVSS)
- [CVE-2013-1056](https://cve.now/CVE-2013-1056.md): X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privileges (no CVSS)
- [CVE-2013-2102](https://cve.now/CVE-2013-2102.md): The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups (no CVSS)
- [CVE-2013-2186](https://cve.now/CVE-2013-2186.md): The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red H (no CVSS, commons-fileupload:commons-fileupload)
- [CVE-2013-5430](https://cve.now/CVE-2013-5430.md): The Jazz Team Server component in IBM Security AppScan Enterprise 8.x before 8.8 has a default username and password, which makes it easier (no CVSS)
- [CVE-2013-6018](https://cve.now/CVE-2013-6018.md): Cross-site request forgery (CSRF) vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the aut (no CVSS)
- [CVE-2013-6019](https://cve.now/CVE-2013-6019.md): Cross-site scripting (XSS) vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2013-6020](https://cve.now/CVE-2013-6020.md): passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depen (no CVSS)
- [CVE-2013-6285](https://cve.now/CVE-2013-6285.md): The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-st (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.