# CVEs published 2013-12-30

13 CVEs were published on December 30, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7209](https://cve.now/CVE-2013-7209.md): Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the au (no CVSS)
- [CVE-2013-4858](https://cve.now/CVE-2013-4858.md): Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) via a cr (no CVSS)
- [CVE-2013-5037](https://cve.now/CVE-2013-5037.md): The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA o (no CVSS)
- [CVE-2013-5038](https://cve.now/CVE-2013-5038.md): The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP address that had prev (no CVSS)
- [CVE-2013-5039](https://cve.now/CVE-2013-5039.md): Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.11 allows remote atta (no CVSS)
- [CVE-2013-5210](https://cve.now/CVE-2013-5210.md): Cross-site scripting (XSS) vulnerability in the GUI login page in ADTRAN AOS before R10.8.1 on the NetVanta 7100 allows remote attackers to (no CVSS)
- [CVE-2013-5218](https://cve.now/CVE-2013-5218.md): Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2013-5219](https://cve.now/CVE-2013-5219.md): Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2013-5220](https://cve.now/CVE-2013-5220.md): goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device crash) via crafted H (no CVSS)
- [CVE-2013-5222](https://cve.now/CVE-2013-5222.md): Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web (no CVSS)
- [CVE-2013-7231](https://cve.now/CVE-2013-7231.md): Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated us (no CVSS)
- [CVE-2013-7232](https://cve.now/CVE-2013-7232.md): SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified (no CVSS)
- [CVE-2013-7233](https://cve.now/CVE-2013-7233.md): Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlie (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.