# CVEs published 2013-11-13

49 CVEs were published on November 13, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-2931](https://cve.now/CVE-2013-2931.md): Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other i (no CVSS)
- [CVE-2013-4475](https://cve.now/CVE-2013-4475.md): Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs\_streams\_depot or vfs\_streams\_xattr is enabled (no CVSS)
- [CVE-2013-4476](https://cve.now/CVE-2013-4476.md): Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, (no CVSS)
- [CVE-2013-5378](https://cve.now/CVE-2013-5378.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.x before 8.0.0.1 CF8 allows remote authenticated users to inject arbitrar (no CVSS)
- [CVE-2013-5379](https://cve.now/CVE-2013-5379.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.x before 7.0.0.2 CF25 and 8.x before 8.0.0.1 CF8 allows remote authentica (no CVSS)
- [CVE-2013-5442](https://cve.now/CVE-2013-5442.md): Cross-site scripting (XSS) vulnerability in the Local Management Interface (LMI) in IBM Security Network Protection on XGS 5100 devices with (no CVSS)
- [CVE-2013-5450](https://cve.now/CVE-2013-5450.md): IBM Security AppScan Enterprise 8.5 through 8.7.0.1, when Jazz authentication is enabled, allows man-in-the-middle attackers to obtain sensi (no CVSS)
- [CVE-2013-5453](https://cve.now/CVE-2013-5453.md): IBM Security AppScan Enterprise 5.6 through 8.7.0.1 allows remote authenticated users to read arbitrary report files by leveraging knowledge (no CVSS)
- [CVE-2013-5552](https://cve.now/CVE-2013-5552.md): Cisco IOS 12.4(24)MDB9 and earlier on Content Services Gateway (CSG) devices does not properly implement the "parse error drop" feature, whi (no CVSS)
- [CVE-2013-5560](https://cve.now/CVE-2013-5560.md): The IPv6 implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1.3 and earlier, when NAT64 or NAT66 is enabled, does not prop (no CVSS)
- [CVE-2013-5568](https://cve.now/CVE-2013-5568.md): The auto-update implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier allows remote attackers to cause a de (no CVSS)
- [CVE-2013-5990](https://cve.now/CVE-2013-5990.md): Unspecified vulnerability in JustSystems Ichitaro 2006 through 2011; Ichitaro Government 6, 7, and 2006 through 2010; Ichitaro 2011 Sou; Ich (no CVSS)
- [CVE-2013-6357](https://cve.now/CVE-2013-6357.md): Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hi (no CVSS)
- [CVE-2013-6621](https://cve.now/CVE-2013-6621.md): Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2013-6622](https://cve.now/CVE-2013-6622.md): Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink, as used in G (no CVSS)
- [CVE-2013-6623](https://cve.now/CVE-2013-6623.md): The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service (out-of- (no CVSS)
- [CVE-2013-6624](https://cve.now/CVE-2013-6624.md): Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2013-6625](https://cve.now/CVE-2013-6625.md): Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers t (no CVSS)
- [CVE-2013-6626](https://cve.now/CVE-2013-6626.md): The WebContentsImpl::AttachInterstitialPage function in content/browser/web\_contents/web\_contents\_impl.cc in Google Chrome before 31.0.1650. (no CVSS)
- [CVE-2013-6627](https://cve.now/CVE-2013-6627.md): net/http/http\_stream\_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, whi (no CVSS)
- [CVE-2013-6628](https://cve.now/CVE-2013-6628.md): net/socket/ssl\_client\_socket\_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 cer (no CVSS)
- [CVE-2013-6682](https://cve.now/CVE-2013-6682.md): The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier does not properly validate X.509 cert (no CVSS)
- [CVE-2013-6683](https://cve.now/CVE-2013-6683.md): The IPv6 implementation in Cisco NX-OS does not properly handle neighbor-table adjacencies, which allows remote attackers to cause a denial (no CVSS)
- [CVE-2013-6684](https://cve.now/CVE-2013-6684.md): The web framework on Cisco Wireless LAN Controller (WLC) devices does not properly validate configuration parameters, which allows remote au (no CVSS)
- [CVE-2013-6685](https://cve.now/CVE-2013-6685.md): The firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory block devices, which allows local users to gai (no CVSS)
- [CVE-2013-6780](https://cve.now/CVE-2013-6780.md): Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers (no CVSS)
- [CVE-2013-5326](https://cve.now/CVE-2013-5326.md): Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 bef (no CVSS)
- [CVE-2013-5328](https://cve.now/CVE-2013-5328.md): Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors. (no CVSS)
- [CVE-2013-5329](https://cve.now/CVE-2013-5329.md): Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, A (no CVSS)
- [CVE-2013-5330](https://cve.now/CVE-2013-5330.md): Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, A (no CVSS)
- [CVE-2013-0082](https://cve.now/CVE-2013-0082.md): Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka (no CVSS)
- [CVE-2013-1324](https://cve.now/CVE-2013-1324.md): Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute a (no CVSS)
- [CVE-2013-1325](https://cve.now/CVE-2013-1325.md): Heap-based buffer overflow in Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPer (no CVSS)
- [CVE-2013-2653](https://cve.now/CVE-2013-2653.md): security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct (no CVSS)
- [CVE-2013-3869](https://cve.now/CVE-2013-3869.md): Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, (no CVSS)
- [CVE-2013-3887](https://cve.now/CVE-2013-3887.md): The Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vist (no CVSS)
- [CVE-2013-3898](https://cve.now/CVE-2013-3898.md): Microsoft Windows 8 and Windows Server 2012, when Hyper-V is used, does not ensure memory-address validity, which allows guest OS users to e (no CVSS)
- [CVE-2013-3905](https://cve.now/CVE-2013-3905.md): Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which al (no CVSS)
- [CVE-2013-3908](https://cve.now/CVE-2013-3908.md): Microsoft Internet Explorer 6 through 10 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive informa (no CVSS)
- [CVE-2013-3909](https://cve.now/CVE-2013-3909.md): Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characte (no CVSS)
- [CVE-2013-3910](https://cve.now/CVE-2013-3910.md): Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v (no CVSS)
- [CVE-2013-3911](https://cve.now/CVE-2013-3911.md): Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2013-3912](https://cve.now/CVE-2013-3912.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3914](https://cve.now/CVE-2013-3914.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3915](https://cve.now/CVE-2013-3915.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3916](https://cve.now/CVE-2013-3916.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3917](https://cve.now/CVE-2013-3917.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-3940](https://cve.now/CVE-2013-3940.md): Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Win (no CVSS)
- [CVE-2013-6789](https://cve.now/CVE-2013-6789.md): security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain s (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-11-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.