# CVEs published 2013-12-14

41 CVEs were published on December 14, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-3042](https://cve.now/CVE-2013-3042.md): Directory traversal vulnerability in the server in IBM Rational Software Architect Design Manager and Rhapsody Design Manager 3.x and 4.x be (no CVSS)
- [CVE-2013-3043](https://cve.now/CVE-2013-3043.md): Directory traversal vulnerability in the client in IBM Rational Software Architect Design Manager and Rhapsody Design Manager 3.x and 4.x be (no CVSS)
- [CVE-2013-4000](https://cve.now/CVE-2013-4000.md): Multiple cross-site request forgery (CSRF) vulnerabilities in IBM Cognos Command Center before 10.2 allow remote attackers to hijack the aut (no CVSS)
- [CVE-2013-4001](https://cve.now/CVE-2013-4001.md): Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization (no CVSS)
- [CVE-2013-4845](https://cve.now/CVE-2013-4845.md): Cross-site scripting (XSS) vulnerability on HP Officejet Pro 8500 (aka A909) All-in-One printers allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2013-5438](https://cve.now/CVE-2013-5438.md): Cross-site scripting (XSS) vulnerability in the web server in IBM Flex System Manager (FSM) 1.1.0 through 1.3 allows remote attackers to inj (no CVSS)
- [CVE-2013-6709](https://cve.now/CVE-2013-6709.md): The registration component in Cisco WebEx Training Center provides the training-session URL before payment is completed, which allows remote (no CVSS)
- [CVE-2013-6710](https://cve.now/CVE-2013-6710.md): Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Training Center allows remote attackers to hijack the authentication of unspe (no CVSS)
- [CVE-2013-6711](https://cve.now/CVE-2013-6711.md): Cross-site scripting (XSS) vulnerability in the product-creation administrative page in Cisco WebEx Sales Center allows remote attackers to (no CVSS)
- [CVE-2013-6959](https://cve.now/CVE-2013-6959.md): Open redirect vulnerability in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitrary web sites and conduct phishin (no CVSS)
- [CVE-2013-6960](https://cve.now/CVE-2013-6960.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meeting Center allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2013-6961](https://cve.now/CVE-2013-6961.md): Cross-site scripting (XSS) vulnerability in the Collaboration Partner Access Console (CPAC) in Cisco WebEx Meeting Center allows remote atta (no CVSS)
- [CVE-2013-6962](https://cve.now/CVE-2013-6962.md): Cross-site scripting (XSS) vulnerability in the mobile-browser subsystem in Cisco WebEx Meeting Center allows remote attackers to inject arb (no CVSS)
- [CVE-2013-6963](https://cve.now/CVE-2013-6963.md): Cross-site scripting (XSS) vulnerability in the registration component in Cisco WebEx Training Center allows remote attackers to inject arbi (no CVSS)
- [CVE-2013-6964](https://cve.now/CVE-2013-6964.md): Cisco WebEx Meeting Center allows remote authenticated users to bypass access control and inject content from a different WebEx site via uns (no CVSS)
- [CVE-2013-6965](https://cve.now/CVE-2013-6965.md): The registration component in Cisco WebEx Training Center provides the training-session URL before e-mail confirmation is completed, which a (no CVSS)
- [CVE-2013-6967](https://cve.now/CVE-2013-6967.md): Open redirect vulnerability in the mobile-browser subsystem in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitra (no CVSS)
- [CVE-2013-6968](https://cve.now/CVE-2013-6968.md): Cisco WebEx Training Center provides different error messages for registration attempts depending on whether the e-mail address exists, whic (no CVSS)
- [CVE-2013-6969](https://cve.now/CVE-2013-6969.md): The training-registration page in Cisco WebEx Training Center allows remote attackers to modify unspecified fields via unknown vectors, aka (no CVSS)
- [CVE-2013-6970](https://cve.now/CVE-2013-6970.md): Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses (no CVSS)
- [CVE-2013-6971](https://cve.now/CVE-2013-6971.md): Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phis (no CVSS)
- [CVE-2013-6972](https://cve.now/CVE-2013-6972.md): Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, b (no CVSS)
- [CVE-2013-6973](https://cve.now/CVE-2013-6973.md): Cisco WebEx Training Center allows remote attackers to discover registration IDs via a crafted URL, aka Bug ID CSCul57121. (no CVSS)
- [CVE-2013-4520](https://cve.now/CVE-2013-4520.md): xslt.c in libxslt before 1.1.25 allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD, (no CVSS)
- [CVE-2013-6271](https://cve.now/CVE-2013-6271.md): Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invok (no CVSS)
- [CVE-2013-7105](https://cve.now/CVE-2013-7105.md): Buffer overflow in the Interstage HTTP Server log functionality, as used in Fujitsu Interstage Application Server 9.0.0, 9.1.0, 9.2.0, 9.3.1 (no CVSS)
- [CVE-2013-4587](https://cve.now/CVE-2013-4587.md): Array index error in the kvm\_vm\_ioctl\_create\_vcpu function in virt/kvm/kvm\_main.c in the KVM subsystem in the Linux kernel through 3.12.5 al (no CVSS)
- [CVE-2013-6367](https://cve.now/CVE-2013-6367.md): The apic\_get\_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a (no CVSS)
- [CVE-2013-6368](https://cve.now/CVE-2013-6368.md): The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a (no CVSS)
- [CVE-2013-6376](https://cve.now/CVE-2013-6376.md): The recalculate\_apic\_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to c (no CVSS)
- [CVE-2013-1364](https://cve.now/CVE-2013-1364.md): The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf p (no CVSS)
- [CVE-2013-5107](https://cve.now/CVE-2013-5107.md): Directory traversal vulnerability in RockMongo 1.1.5 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2013-6051](https://cve.now/CVE-2013-6051.md): The bgp\_attr\_unknown function in bgp\_attr.c in Quagga 0.99.21 does not properly initialize the total variable, which allows remote attackers (no CVSS)
- [CVE-2013-6391](https://cve.now/CVE-2013-6391.md): The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped toke (no CVSS)
- [CVE-2013-6411](https://cve.now/CVE-2013-6411.md): The HandleCrashedAircraft function in aircraft\_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2013-6426](https://cve.now/CVE-2013-6426.md): The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not prope (no CVSS)
- [CVE-2013-6428](https://cve.now/CVE-2013-6428.md): The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users t (no CVSS)
- [CVE-2013-7069](https://cve.now/CVE-2013-7069.md): ack 2.00 through 2.11\_02 allows remote attackers to execute arbitrary code via a (1) --pager, (2) --regex, or (3) --output option in a .ackr (no CVSS)
- [CVE-2013-7085](https://cve.now/CVE-2013-7085.md): Uscan in devscripts 2.13.5, when USCAN\_EXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in (no CVSS)
- [CVE-2013-7103](https://cve.now/CVE-2013-7103.md): McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attr (no CVSS)
- [CVE-2013-7104](https://cve.now/CVE-2013-7104.md): McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.