# CVEs published 2013-12-21

32 CVEs were published on December 21, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2012-4131](https://cve.now/CVE-2012-4131.md): Directory traversal vulnerability in tar in Cisco NX-OS allows local users to access arbitrary files via crafted command-line arguments, aka (no CVSS)
- [CVE-2012-4135](https://cve.now/CVE-2012-4135.md): Directory traversal vulnerability in filesys in Cisco NX-OS 6.1(2) and earlier allows local users to access arbitrary files via crafted comm (no CVSS)
- [CVE-2013-2821](https://cve.now/CVE-2013-2821.md): NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.2 (no CVSS)
- [CVE-2013-2822](https://cve.now/CVE-2013-2822.md): NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.2 (no CVSS)
- [CVE-2013-4044](https://cve.now/CVE-2013-4044.md): IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read applica (no CVSS)
- [CVE-2013-4045](https://cve.now/CVE-2013-4045.md): Cross-site scripting (XSS) vulnerability in the Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF (no CVSS)
- [CVE-2013-4046](https://cve.now/CVE-2013-4046.md): Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote atta (no CVSS)
- [CVE-2013-4063](https://cve.now/CVE-2013-4063.md): Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1 allows remote attackers to in (no CVSS)
- [CVE-2013-4064](https://cve.now/CVE-2013-4064.md): Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is ena (no CVSS)
- [CVE-2013-4065](https://cve.now/CVE-2013-4065.md): Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is ena (no CVSS)
- [CVE-2013-4069](https://cve.now/CVE-2013-4069.md): The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers (no CVSS)
- [CVE-2013-4070](https://cve.now/CVE-2013-4070.md): The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers (no CVSS)
- [CVE-2013-5405](https://cve.now/CVE-2013-5405.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authentica (no CVSS)
- [CVE-2013-5406](https://cve.now/CVE-2013-5406.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authentica (no CVSS)
- [CVE-2013-5407](https://cve.now/CVE-2013-5407.md): IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authentica (no CVSS)
- [CVE-2013-5409](https://cve.now/CVE-2013-5409.md): Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to (no CVSS)
- [CVE-2013-5411](https://cve.now/CVE-2013-5411.md): IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or ac (no CVSS)
- [CVE-2013-5413](https://cve.now/CVE-2013-5413.md): IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attacker (no CVSS)
- [CVE-2013-6196](https://cve.now/CVE-2013-6196.md): Cross-site scripting (XSS) vulnerability in HP Autonomy Ultraseek 5 allows remote authenticated users to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-6978](https://cve.now/CVE-2013-6978.md): The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated us (no CVSS)
- [CVE-2013-2627](https://cve.now/CVE-2013-2627.md): SQL injection vulnerability in action.php in Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2013-2628](https://cve.now/CVE-2013-2628.md): Multiple cross-site request forgery (CSRF) vulnerabilities in action.php in Leed (Light Feed), possibly before 1.5 Stable, allow remote atta (no CVSS)
- [CVE-2013-6162](https://cve.now/CVE-2013-6162.md): Cross-site scripting (XSS) vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2013-7002](https://cve.now/CVE-2013-7002.md): Cross-site scripting (XSS) vulnerability in mobile/php/translation/index.php in LiveZilla before 5.1.1.0 allows remote attackers to inject a (no CVSS)
- [CVE-2013-7074](https://cve.now/CVE-2013-7074.md): Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x befo (no CVSS, typo3/cms)
- [CVE-2013-7076](https://cve.now/CVE-2013-7076.md): Cross-site scripting (XSS) vulnerability in Extension Manager in TYPO3 4.5.x before 4.5.32 and 4.7.x before 4.7.17 allows remote attackers t (no CVSS)
- [CVE-2013-7077](https://cve.now/CVE-2013-7077.md): Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allow (no CVSS, typo3/cms-core)
- [CVE-2013-7082](https://cve.now/CVE-2013-7082.md): Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x b (no CVSS, neos/flow · typo3/flow)
- [CVE-2013-7191](https://cve.now/CVE-2013-7191.md): Cross-site scripting (XSS) vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the P (no CVSS)
- [CVE-2013-7192](https://cve.now/CVE-2013-7192.md): Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2013-7193](https://cve.now/CVE-2013-7193.md): Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2013-7194](https://cve.now/CVE-2013-7194.md): Multiple cross-site scripting (XSS) vulnerabilities in www/administrator.php in eFront 3.6.14 (build 18012) allow remote authenticated admin (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.