# CVEs published 2013-12-19 23 CVEs were published on December 19, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-5422](https://cve.now/CVE-2013-5422.md): The Web Client in IBM Rational ClearQuest 7.1 through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2, when a multi-database da (no CVSS) - [CVE-2013-5426](https://cve.now/CVE-2013-5426.md): Session fixation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 IF5 and 11.0 before IF1 and (no CVSS) - [CVE-2013-5452](https://cve.now/CVE-2013-5452.md): IBM FileNet Business Process Framework 4.1.0 allows remote authenticated users to read arbitrary files or send TCP requests to intranet serv (no CVSS) - [CVE-2013-5462](https://cve.now/CVE-2013-5462.md): IBM/ECMClient/configure/explodedformat/navigator/header.jsp in IBM Content Navigator 2.0.0, 2.0.1 before 2.0.1.2-ICN-FP002, and 2.0.2 before (no CVSS) - [CVE-2013-6178](https://cve.now/CVE-2013-6178.md): Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.4 SP1 allow remote attackers to inject arbitrary web (no CVSS) - [CVE-2013-6717](https://cve.now/CVE-2013-6717.md): The OLAP query engine in IBM DB2 and DB2 Connect 9.7 through FP9, 9.8 through FP5, 10.1 through FP3, and 10.5 through FP2, and the DB2 pureS (no CVSS) - [CVE-2013-6877](https://cve.now/CVE-2013-6877.md): Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allows remote atta (no CVSS) - [CVE-2013-6976](https://cve.now/CVE-2013-6976.md): Cross-site request forgery (CSRF) vulnerability in goform/Quick\_setup on Cisco EPC3925 devices allows remote attackers to hijack the authent (no CVSS) - [CVE-2013-7100](https://cve.now/CVE-2013-7100.md): Buffer overflow in the unpacksms16 function in apps/app\_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x b (no CVSS) - [CVE-2013-7112](https://cve.now/CVE-2013-7112.md): The dissect\_sip\_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10 (no CVSS) - [CVE-2013-7113](https://cve.now/CVE-2013-7113.md): epan/dissectors/packet-bssgp.c in the BSSGP dissector in Wireshark 1.10.x before 1.10.4 incorrectly relies on a global variable, which allow (no CVSS) - [CVE-2013-7114](https://cve.now/CVE-2013-7114.md): Multiple buffer overflows in the create\_ntlmssp\_v2\_key function in epan/dissectors/packet-ntlmssp.c in the NTLMSSP v2 dissector in Wireshark (no CVSS) - [CVE-2013-7136](https://cve.now/CVE-2013-7136.md): The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does not have a sufficiently large number of possible WPA-PSK passphrases, which mak (no CVSS) - [CVE-2013-4775](https://cve.now/CVE-2013-4775.md): NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier; GS748Tv4 with firmware 5.4.1.14; GS510TP with firmware 5.4.0.6; GS (no CVSS) - [CVE-2013-4776](https://cve.now/CVE-2013-4776.md): NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier, GS748Tv4 5.4.1.14, and GS510TP 5.0.4.4 allows remote attackers to (no CVSS) - [CVE-2013-5946](https://cve.now/CVE-2013-5946.md): The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 a (no CVSS) - [CVE-2013-6824](https://cve.now/CVE-2013-6824.md): Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary command (no CVSS) - [CVE-2013-6836](https://cve.now/CVE-2013-6836.md): Heap-based buffer overflow in the ms\_escher\_get\_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows rem (no CVSS) - [CVE-2013-6837](https://cve.now/CVE-2013-6837.md): Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remo (no CVSS) - [CVE-2013-7004](https://cve.now/CVE-2013-7004.md): D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and D (no CVSS) - [CVE-2013-7005](https://cve.now/CVE-2013-7005.md): D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and D (no CVSS) - [CVE-2013-7067](https://cve.now/CVE-2013-7067.md): The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which a (no CVSS) - [CVE-2013-7086](https://cve.now/CVE-2013-7086.md): The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to exec (no CVSS, webbynode) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-12-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.