# CVEs published 2013-12-13 27 CVEs were published on December 13, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-7093](https://cve.now/CVE-2013-7093.md): SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecif (no CVSS) - [CVE-2013-7094](https://cve.now/CVE-2013-7094.md): SQL injection vulnerability in the RSDDCVER\_COUNT\_TAB\_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL c (no CVSS) - [CVE-2013-7095](https://cve.now/CVE-2013-7095.md): The XML parser (crm\_flex\_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an (no CVSS) - [CVE-2013-7096](https://cve.now/CVE-2013-7096.md): Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS) - [CVE-2012-5394](https://cve.now/CVE-2012-5394.md): Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x b (no CVSS) - [CVE-2013-0348](https://cve.now/CVE-2013-0348.md): thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to ob (no CVSS) - [CVE-2013-4567](https://cve.now/CVE-2013-4567.md): Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows (no CVSS) - [CVE-2013-4568](https://cve.now/CVE-2013-4568.md): Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows (no CVSS) - [CVE-2013-4569](https://cve.now/CVE-2013-4569.md): The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recen (no CVSS) - [CVE-2013-6394](https://cve.now/CVE-2013-6394.md): Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which makes it easier for local users to defeat c (no CVSS) - [CVE-2013-6956](https://cve.now/CVE-2013-6956.md): Cross-site scripting (XSS) vulnerability in the Secure Access Service Web rewriting feature in Juniper Junos Pulse Secure Access Service (ak (no CVSS) - [CVE-2013-6957](https://cve.now/CVE-2013-6957.md): Cross-site scripting (XSS) vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2013-6958](https://cve.now/CVE-2013-6958.md): Juniper NetScreen Firewall running ScreenOS 5.4, 6.2, or 6.3, when the Ping of Death screen is disabled, allows remote attackers to cause a (no CVSS) - [CVE-2013-7050](https://cve.now/CVE-2013-7050.md): The get\_main\_source\_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN\_EXCLUSION, allows remote attackers to exe (no CVSS) - [CVE-2013-7091](https://cve.now/CVE-2013-7091.md): Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 (no CVSS) - [CVE-2013-7092](https://cve.now/CVE-2013-7092.md): Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to exe (no CVSS) - [CVE-2012-6151](https://cve.now/CVE-2012-6151.md): Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a d (no CVSS) - [CVE-2013-5676](https://cve.now/CVE-2013-5676.md): The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by (no CVSS, org.jenkins-ci.plugins:sonar) - [CVE-2013-6048](https://cve.now/CVE-2013-6048.md): The get\_group\_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infin (no CVSS) - [CVE-2013-6359](https://cve.now/CVE-2013-6359.md): Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a plugi (no CVSS) - [CVE-2013-6400](https://cve.now/CVE-2013-6400.md): Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes whe (no CVSS) - [CVE-2013-6809](https://cve.now/CVE-2013-6809.md): Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service (crash) or possibly exec (no CVSS) - [CVE-2013-7038](https://cve.now/CVE-2013-7038.md): The MHD\_http\_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial (no CVSS) - [CVE-2013-7039](https://cve.now/CVE-2013-7039.md): Stack-based buffer overflow in the MHD\_digest\_auth\_check function in libmicrohttpd before 0.9.32, when MHD\_OPTION\_CONNECTION\_MEMORY\_LIMIT is (no CVSS) - [CVE-2013-4988](https://cve.now/CVE-2013-4988.md): Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDI (no CVSS) - [CVE-2013-6005](https://cve.now/CVE-2013-6005.md): Cross-site scripting (XSS) vulnerability in Cybozu Dezie before 8.1.0 allows remote attackers to inject arbitrary web script or HTML via vec (no CVSS) - [CVE-2013-6839](https://cve.now/CVE-2013-6839.md): SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the o (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-12-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.