# CVEs published 2013-12-23 22 CVEs were published on December 23, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-3709](https://cve.now/CVE-2013-3709.md): WebYaST 1.3 uses weak permissions for config/initializers/secret\_token.rb, which allows local users to gain privileges by reading the Rails (no CVSS) - [CVE-2013-4424](https://cve.now/CVE-2013-4424.md): Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to i (no CVSS) - [CVE-2013-7049](https://cve.now/CVE-2013-7049.md): Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote a (no CVSS) - [CVE-2013-7073](https://cve.now/CVE-2013-7073.md): The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 doe (no CVSS, typo3/cms) - [CVE-2013-7075](https://cve.now/CVE-2013-7075.md): The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 all (no CVSS, typo3/cms) - [CVE-2013-7079](https://cve.now/CVE-2013-7079.md): Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 thr (no CVSS, friendsoftypo3/openid) - [CVE-2013-7080](https://cve.now/CVE-2013-7080.md): The creating record functionality in Extension table administration library (feuser\_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 throu (no CVSS, typo3/cms-core) - [CVE-2013-7081](https://cve.now/CVE-2013-7081.md): The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 (no CVSS, typo3/cms-core) - [CVE-2013-7102](https://cve.now/CVE-2013-7102.md): Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq\_button.php (no CVSS) - [CVE-2013-4404](https://cve.now/CVE-2013-4404.md): cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended ro (no CVSS) - [CVE-2013-4405](https://cve.now/CVE-2013-4405.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote at (no CVSS) - [CVE-2013-4414](https://cve.now/CVE-2013-4414.md): Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject (no CVSS) - [CVE-2013-4461](https://cve.now/CVE-2013-4461.md): SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary S (no CVSS) - [CVE-2013-4549](https://cve.now/CVE-2013-4549.md): QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Exp (no CVSS) - [CVE-2013-5420](https://cve.now/CVE-2013-5420.md): The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users (no CVSS) - [CVE-2013-6422](https://cve.now/CVE-2013-6422.md): The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT\_SSL\_VERIFYPEER), also disables t (no CVSS) - [CVE-2013-6439](https://cve.now/CVE-2013-6439.md): Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not speci (no CVSS) - [CVE-2013-6449](https://cve.now/CVE-2013-6449.md): The ssl\_get\_algorithm2 function in ssl/s3\_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, w (no CVSS) - [CVE-2013-6890](https://cve.now/CVE-2013-6890.md): denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of se (no CVSS) - [CVE-2013-6979](https://cve.now/CVE-2013-6979.md): The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configu (no CVSS) - [CVE-2013-2629](https://cve.now/CVE-2013-2629.md): Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the (1) importForm, (2 (no CVSS) - [CVE-2013-5973](https://cve.now/CVE-2013-5973.md): VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-12-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.