# CVEs published 2013-11-05 23 CVEs were published on November 5, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2012-4502](https://cve.now/CVE-2012-4502.md): Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1 (no CVSS) - [CVE-2012-4503](https://cve.now/CVE-2012-4503.md): cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (no CVSS) - [CVE-2013-4134](https://cve.now/CVE-2013-4134.md): OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for r (no CVSS) - [CVE-2013-4135](https://cve.now/CVE-2013-4135.md): The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext (no CVSS) - [CVE-2013-5688](https://cve.now/CVE-2013-5688.md): Multiple directory traversal vulnerabilities in index.php in AjaXplorer 5.0.2 and earlier allow remote authenticated users to read arbitrary (no CVSS) - [CVE-2013-3263](https://cve.now/CVE-2013-3263.md): Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow (no CVSS) - [CVE-2013-3264](https://cve.now/CVE-2013-3264.md): The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2 (no CVSS) - [CVE-2013-4419](https://cve.now/CVE-2013-4419.md): The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ow (no CVSS) - [CVE-2013-4453](https://cve.now/CVE-2013-4453.md): Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remote attackers to injec (no CVSS) - [CVE-2013-4497](https://cve.now/CVE-2013-4497.md): The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when re (no CVSS, nova) - [CVE-2013-5694](https://cve.now/CVE-2013-5694.md): SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2013-5695](https://cve.now/CVE-2013-5695.md): Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2013-6618](https://cve.now/CVE-2013-6618.md): jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12. (no CVSS) - [CVE-2011-5267](https://cve.now/CVE-2011-5267.md): Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, as used in WikiWig 5.0 (no CVSS) - [CVE-2013-4435](https://cve.now/CVE-2013-4435.md): Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute (no CVSS, salt) - [CVE-2013-4436](https://cve.now/CVE-2013-4436.md): The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote at (no CVSS, salt) - [CVE-2013-4437](https://cve.now/CVE-2013-4437.md): Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp." (no CVSS, salt) - [CVE-2013-4438](https://cve.now/CVE-2013-4438.md): Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. (no CVSS, salt) - [CVE-2013-4439](https://cve.now/CVE-2013-4439.md): Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion (no CVSS, salt) - [CVE-2013-5670](https://cve.now/CVE-2013-5670.md): Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7 (no CVSS) - [CVE-2013-6077](https://cve.now/CVE-2013-6077.md): Citrix XenDesktop 7.0, when upgraded from XenDesktop 5.x, does not properly enforce policy rule permissions, which allows remote attackers t (no CVSS) - [CVE-2013-6172](https://cve.now/CVE-2013-6172.md): steps/utils/save\_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings (no CVSS) - [CVE-2013-6617](https://cve.now/CVE-2013-6617.md): The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote atta (no CVSS, salt) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-11-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.