# CVEs published 2013-11-02

24 CVEs were published on November 2, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-6023](https://cve.now/CVE-2013-6023.md): Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbi (no CVSS)
- [CVE-2013-6111](https://cve.now/CVE-2013-6111.md): Cross-site scripting (XSS) vulnerability in the mod\_pagespeed module 0.x, 1.0.22.7, 1.1.x, 1.24.1, 1.3.25.1 through 1.3.25.4, 1.4.26.1 throu (no CVSS)
- [CVE-2013-6348](https://cve.now/CVE-2013-6348.md): Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML (no CVSS, org.apache.struts:struts2-core)
- [CVE-2013-6349](https://cve.now/CVE-2013-6349.md): McAfee Email Gateway (MEG) 7.0 before 7.0.4 and 7.5 before 7.5.1 allows remote authenticated users to execute arbitrary commands via unspeci (no CVSS)
- [CVE-2013-6344](https://cve.now/CVE-2013-6344.md): The ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows attackers to conduct cross-frame scripting attacks via u (no CVSS)
- [CVE-2013-6345](https://cve.now/CVE-2013-6345.md): Unspecified vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 has unknown impact and attack vect (no CVSS)
- [CVE-2013-6346](https://cve.now/CVE-2013-6346.md): Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remot (no CVSS)
- [CVE-2013-6347](https://cve.now/CVE-2013-6347.md): Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web session (no CVSS)
- [CVE-2013-1084](https://cve.now/CVE-2013-1084.md): Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allow (no CVSS)
- [CVE-2013-2065](https://cve.now/CVE-2013-2065.md): (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native (no CVSS)
- [CVE-2013-3285](https://cve.now/CVE-2013-3285.md): The NetWorker Management Console (NMC) in EMC NetWorker 8.0.x before 8.0.2.3, when using Active Directory/LDAP for authentication, allows re (no CVSS)
- [CVE-2013-3287](https://cve.now/CVE-2013-3287.md): EMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP configurations, allows local users to discov (no CVSS)
- [CVE-2013-3617](https://cve.now/CVE-2013-3617.md): The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an ext (no CVSS)
- [CVE-2013-3631](https://cve.now/CVE-2013-3631.md): NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advance (no CVSS)
- [CVE-2013-4282](https://cve.now/CVE-2013-4282.md): Stack-based buffer overflow in the reds\_handle\_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2013-4416](https://cve.now/CVE-2013-4416.md): The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (doma (no CVSS)
- [CVE-2013-4477](https://cve.now/CVE-2013-4477.md): The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that rol (no CVSS, keystone)
- [CVE-2013-2652](https://cve.now/CVE-2013-2652.md): CRLF injection vulnerability in help/help\_language.php in WebCollab 3.30 and earlier allows remote attackers to inject arbitrary HTTP header (no CVSS)
- [CVE-2013-4401](https://cve.now/CVE-2013-4401.md): The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:wr (no CVSS)
- [CVE-2013-4457](https://cve.now/CVE-2013-4457.md): The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, rela (no CVSS, cocaine)
- [CVE-2013-4469](https://cve.now/CVE-2013-4469.md): OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use\_cow\_images is set to False, does not verify the virtual size of a QCOW2 image (no CVSS, nova)
- [CVE-2013-4494](https://cve.now/CVE-2013-4494.md): Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page\_alloc\_lock and grant\_table.lock in the same order, which allows local guest admini (no CVSS)
- [CVE-2013-6075](https://cve.now/CVE-2013-6075.md): The compare\_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (no CVSS)
- [CVE-2013-6076](https://cve.now/CVE-2013-6076.md): strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-11-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.