# CVEs published 2013-12-24

15 CVEs were published on December 24, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7216](https://cve.now/CVE-2013-7216.md): Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID pa (no CVSS)
- [CVE-2012-6615](https://cve.now/CVE-2012-6615.md): The ff\_ass\_split\_override\_codes function in libavcodec/ass\_split.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2012-6616](https://cve.now/CVE-2012-6616.md): The mov\_text\_decode\_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (o (no CVSS)
- [CVE-2012-6617](https://cve.now/CVE-2012-6617.md): The prepare\_sdp\_description function in ffserver.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (crash) via v (no CVSS)
- [CVE-2012-6618](https://cve.now/CVE-2012-6618.md): The av\_probe\_input\_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote (no CVSS)
- [CVE-2013-6387](https://cve.now/CVE-2013-6387.md): Cross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permis (no CVSS)
- [CVE-2013-6388](https://cve.now/CVE-2013-6388.md): Cross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2011-5268](https://cve.now/CVE-2011-5268.md): connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descripto (no CVSS)
- [CVE-2013-4358](https://cve.now/CVE-2013-4358.md): libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bi (no CVSS)
- [CVE-2013-4452](https://cve.now/CVE-2013-4452.md): Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows lo (no CVSS)
- [CVE-2013-4553](https://cve.now/CVE-2013-4553.md): The XEN\_DOMCTL\_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page\_alloc\_lock and mm\_rwlock in (no CVSS)
- [CVE-2013-4554](https://cve.now/CVE-2013-4554.md): Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercall (no CVSS)
- [CVE-2013-4550](https://cve.now/CVE-2013-4550.md): Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with (no CVSS)
- [CVE-2013-6403](https://cve.now/CVE-2013-6403.md): The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to (no CVSS)
- [CVE-2013-6795](https://cve.now/CVE-2013-6795.md): The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.