# CVEs published 2013-12-28

11 CVEs were published on December 28, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-1096](https://cve.now/CVE-2013-1096.md): Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell Identity Manager (aka (no CVSS)
- [CVE-2013-6006](https://cve.now/CVE-2013-6006.md): Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request. (no CVSS)
- [CVE-2013-6181](https://cve.now/CVE-2013-6181.md): EMC Watch4Net before 6.3 stores cleartext polled-device passwords in the installation repository, which allows local users to obtain sensiti (no CVSS)
- [CVE-2013-6182](https://cve.now/CVE-2013-6182.md): Unquoted Windows search path vulnerability in EMC Replication Manager before 5.5 allows local users to gain privileges via a crafted applica (no CVSS)
- [CVE-2013-6808](https://cve.now/CVE-2013-6808.md): Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2013-6812](https://cve.now/CVE-2013-6812.md): The ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s (no CVSS)
- [CVE-2013-6886](https://cve.now/CVE-2013-6886.md): RealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a crafted argument to the (1) vncserver, (2) vncser (no CVSS)
- [CVE-2013-6929](https://cve.now/CVE-2013-6929.md): SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via cra (no CVSS)
- [CVE-2013-6932](https://cve.now/CVE-2013-6932.md): Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used, allows user-assisted remote attackers to execut (no CVSS)
- [CVE-2013-6981](https://cve.now/CVE-2013-6981.md): Cisco IOS XE 3.7S(.1) and earlier allows remote attackers to cause a denial of service (Packet Processor crash) via fragmented MPLS IP packe (no CVSS)
- [CVE-2013-7149](https://cve.now/CVE-2013-7149.md): SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and Op (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.