# CVEs published 2013-11-15 22 CVEs were published on November 15, 2013: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2013-0741](https://cve.now/CVE-2013-0741.md): Cross-site scripting (XSS) vulnerability in imagegen.ashx in Percipient Studios ImageGen before 2.9.0 for Umbraco CMS allows remote attacker (no CVSS) - [CVE-2013-2271](https://cve.now/CVE-2013-2271.md): The D-Link DSL-2740B Gateway with firmware EU\_1.0, when an active administrator session exists, allows remote attackers to bypass authentica (no CVSS) - [CVE-2013-4519](https://cve.now/CVE-2013-4519.md): Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to in (no CVSS) - [CVE-2013-5223](https://cve.now/CVE-2013-5223.md): Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. (CVSS 5.4, KEV) - [CVE-2013-6042](https://cve.now/CVE-2013-6042.md): Cross-site scripting (XSS) vulnerability in filemanager/login.php in the File Manager module in Softaculous Webuzo before 2.1.4 allows remot (no CVSS) - [CVE-2013-6629](https://cve.now/CVE-2013-6629.md): The get\_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghos (no CVSS) - [CVE-2013-6630](https://cve.now/CVE-2013-6630.md): The get\_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not (no CVSS) - [CVE-2013-6631](https://cve.now/CVE-2013-6631.md): Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice\_engine/channel.cc in libjingle in WebRTC, as used in Google Ch (no CVSS) - [CVE-2013-6797](https://cve.now/CVE-2013-6797.md): Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordP (no CVSS) - [CVE-2013-1057](https://cve.now/CVE-2013-1057.md): Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan (no CVSS) - [CVE-2013-2031](https://cve.now/CVE-2013-2031.md): MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a (no CVSS) - [CVE-2013-2032](https://cve.now/CVE-2013-2032.md): MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordRe (no CVSS) - [CVE-2013-2061](https://cve.now/CVE-2013-2061.md): The openvpn\_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive (no CVSS) - [CVE-2013-2114](https://cve.now/CVE-2013-2114.md): Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attac (no CVSS) - [CVE-2013-4204](https://cve.now/CVE-2013-4204.md): Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow (no CVSS, com.google.gwt:gwt) - [CVE-2013-4425](https://cve.now/CVE-2013-4425.md): The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" a (no CVSS) - [CVE-2013-4480](https://cve.now/CVE-2013-4480.md): Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows rem (no CVSS) - [CVE-2013-4510](https://cve.now/CVE-2013-4510.md): Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write (no CVSS, tryton ยท trytond) - [CVE-2013-4551](https://cve.now/CVE-2013-4551.md): Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, (no CVSS) - [CVE-2013-4555](https://cve.now/CVE-2013-4555.md): Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the auth (no CVSS) - [CVE-2013-4556](https://cve.now/CVE-2013-4556.md): Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer\_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0 (no CVSS) - [CVE-2013-4557](https://cve.now/CVE-2013-4557.md): The Security Screen (\_core\_/securite/ecran\_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-11-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.