# CVEs published 2013-11-19

29 CVEs were published on November 19, 2013: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-4386](https://cve.now/CVE-2013-4386.md): Multiple SQL injection vulnerabilities in app/models/concerns/host\_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbit (no CVSS)
- [CVE-2013-4466](https://cve.now/CVE-2013-4466.md): Buffer overflow in the dane\_query\_tlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows re (no CVSS)
- [CVE-2013-4487](https://cve.now/CVE-2013-4487.md): Off-by-one error in the dane\_raw\_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote serve (no CVSS)
- [CVE-2013-4495](https://cve.now/CVE-2013-4495.md): The send\_the\_mail function in server/svr\_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2 (no CVSS)
- [CVE-2013-4559](https://cve.now/CVE-2013-4559.md): lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd (no CVSS)
- [CVE-2013-4560](https://cve.now/CVE-2013-4560.md): Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) v (no CVSS)
- [CVE-2013-6814](https://cve.now/CVE-2013-6814.md): The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing (no CVSS)
- [CVE-2013-6815](https://cve.now/CVE-2013-6815.md): The SHSTI\_UPLOAD\_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to caus (no CVSS)
- [CVE-2013-6816](https://cve.now/CVE-2013-6816.md): Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote (no CVSS)
- [CVE-2013-6817](https://cve.now/CVE-2013-6817.md): Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute (no CVSS)
- [CVE-2013-6818](https://cve.now/CVE-2013-6818.md): SAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended access restrictions via unspecified vector (no CVSS)
- [CVE-2013-6819](https://cve.now/CVE-2013-6819.md): Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2013-6820](https://cve.now/CVE-2013-6820.md): Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2013-6821](https://cve.now/CVE-2013-6821.md): Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via un (no CVSS)
- [CVE-2013-6822](https://cve.now/CVE-2013-6822.md): GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issu (no CVSS)
- [CVE-2013-6823](https://cve.now/CVE-2013-6823.md): GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors. (no CVSS)
- [CVE-2013-6826](https://cve.now/CVE-2013-6826.md): cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf\_token paramet (no CVSS)
- [CVE-2013-3095](https://cve.now/CVE-2013-3095.md): Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR865L router (Rev. (no CVSS)
- [CVE-2013-4507](https://cve.now/CVE-2013-4507.md): Cross-site scripting (XSS) vulnerability in CollectiveAccess Providence and Pawtucket before 1.3.1 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2013-4563](https://cve.now/CVE-2013-4563.md): The udp6\_ufo\_fragment function in net/ipv6/udp\_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, (no CVSS)
- [CVE-2013-4579](https://cve.now/CVE-2013-4579.md): The ath9k\_htc\_set\_bssid\_mask function in drivers/net/wireless/ath/ath9k/htc\_drv\_main.c in the Linux kernel through 3.12 uses a BSSID masking (no CVSS)
- [CVE-2013-4588](https://cve.now/CVE-2013-4588.md): Multiple stack-based buffer overflows in net/netfilter/ipvs/ip\_vs\_ctl.c in the Linux kernel before 2.6.33, when CONFIG\_IP\_VS is used, allow (no CVSS)
- [CVE-2013-4591](https://cve.now/CVE-2013-4591.md): Buffer overflow in the \_\_nfs4\_get\_acl\_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a (no CVSS)
- [CVE-2013-4592](https://cve.now/CVE-2013-4592.md): Memory leak in the \_\_kvm\_set\_memory\_region function in virt/kvm/kvm\_main.c in the Linux kernel before 3.9 allows local users to cause a deni (no CVSS)
- [CVE-2013-5215](https://cve.now/CVE-2013-5215.md): Cross-site scripting (XSS) vulnerability in the web interface "WiFi scan" option in FOSCAM Wireless IP Cameras allows remote attackers to in (no CVSS)
- [CVE-2013-5730](https://cve.now/CVE-2013-5730.md): Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU\_1.00 allow remote attackers to hijac (no CVSS)
- [CVE-2013-5966](https://cve.now/CVE-2013-5966.md): Cross-site scripting (XSS) vulnerability in ZK Framework before 5.0.13 allows remote attackers to inject arbitrary web script or HTML via un (no CVSS)
- [CVE-2013-6074](https://cve.now/CVE-2013-6074.md): Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote a (no CVSS)
- [CVE-2013-6282](https://cve.now/CVE-2013-6282.md): The (1) get\_user and (2) put\_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain add (CVSS 8.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-11-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.