# CVEs published 2013-11-27

12 CVEs were published on November 27, 2013: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-5065](https://cve.now/CVE-2013-5065.md): NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted applic (CVSS 7.8, KEV)
- [CVE-2013-3920](https://cve.now/CVE-2013-3920.md): Cross-site scripting (XSS) vulnerability in Jahia xCM before 6.6.2 allows remote authenticated users to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-4617](https://cve.now/CVE-2013-4617.md): Jahia xCM before 6.6.2 does not include the HTTPOnly flag in a Set-Cookie header for the JSESSIONID cookie, which makes it easier for remote (no CVSS)
- [CVE-2013-4624](https://cve.now/CVE-2013-4624.md): Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2013-5957](https://cve.now/CVE-2013-5957.md): Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4 (no CVSS)
- [CVE-2013-3394](https://cve.now/CVE-2013-3394.md): Cross-site scripting (XSS) vulnerability in the web interface in Cisco Prime Network Registrar 8.1 and earlier allows remote attackers to in (no CVSS)
- [CVE-2013-4036](https://cve.now/CVE-2013-4036.md): Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 F (no CVSS)
- [CVE-2013-6378](https://cve.now/CVE-2013-6378.md): The lbs\_debugfs\_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a d (no CVSS)
- [CVE-2013-6380](https://cve.now/CVE-2013-6380.md): The aac\_send\_raw\_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain siz (no CVSS)
- [CVE-2013-6381](https://cve.now/CVE-2013-6381.md): Buffer overflow in the qeth\_snmp\_command function in drivers/s390/net/qeth\_core\_main.c in the Linux kernel through 3.12.1 allows local users (no CVSS)
- [CVE-2013-6382](https://cve.now/CVE-2013-6382.md): Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memo (no CVSS)
- [CVE-2013-6383](https://cve.now/CVE-2013-6383.md): The aac\_compat\_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP\_SYS\_RAWIO capabilit (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.