Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2011

50 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-4719
    35Monitor

    Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files

    HighCVSS 7.5Proof of conceptEPSS 15%

    joomla · joomla\!Feb 1, 2011

  • CVE-2010-3719
    38Monitor

    Eval injection vulnerability in IMAdminSchedTask.asp in the administrative interface for Symantec IM Manager 8.4.16 and earlier allows remot

    HighCVSS 8.5No exploitEPSS 12%

    symantec · im managerFeb 1, 2011

  • CVE-2010-4652
    30Monitor

    Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows r

    MediumCVSS 6.8No exploitEPSS 11%

    proftpd · proftpdFeb 1, 2011

  • CVE-2011-0276
    65This week

    HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager

    CriticalCVSS 10.0WeaponizedEPSS 82%

    hp · openview performance insightFeb 1, 2011

  • CVE-2010-3269
    40Plan

    Multiple stack-based buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP2

    CriticalCVSS 9.3No exploitEPSS 11%

    cisco · webex recording format playerFeb 2, 2011

  • CVE-2011-0354
    44Plan

    The default configuration of Cisco Tandberg C Series Endpoints, and Tandberg E and EX Personal Video units, with software before TC4.0.0 has

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    cisco · tandberg endpointFeb 3, 2011

  • CVE-2011-0049
    49Plan

    Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers

    MediumCVSS 5.0WeaponizedEPSS 95%

    mj2 · majordomo 2Feb 3, 2011

  • CVE-2011-0522
    42Plan

    The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/codec/subtitles/subsusf.

    MediumCVSS 6.8Proof of conceptEPSS 51%

    videolan · vlc media playerFeb 7, 2011

  • CVE-2011-0531
    50Plan

    demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of se

    CriticalCVSS 9.3WeaponizedEPSS 41%

    videolan · vlc media playerFeb 7, 2011

  • CVE-2011-0885
    43Plan

    A certain Comcast Business Gateway configuration of the SMC SMCD3G-CCR with firmware before 1.4.0.49.2 has a default password of D0nt4g3tme

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    smc networks · smcd3g-ccrFeb 8, 2011

  • CVE-2011-0915
    43Plan

    Stack-based buffer overflow in nrouter.exe in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a long nam

    CriticalCVSS 10.0No exploitEPSS 11%

    ibm · lotus dominoFeb 8, 2011

  • CVE-2011-0917
    44Plan

    Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in an LDAP Bind operati

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    ibm · lotus dominoFeb 8, 2011

  • CVE-2011-0920
    40Plan

    The Remote Console in IBM Lotus Domino, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attack

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    ibm · lotus dominoFeb 8, 2011

  • CVE-2011-0031
    22Monitor

    The (1) JScript 5.8 and (2) VBScript 5.8 scripting engines in Microsoft Windows Server 2008 R2 and Windows 7 do not properly load decoded sc

    MediumCVSS 4.3No exploitEPSS 17%

    microsoft · windows 7Feb 8, 2011

  • CVE-2011-0040
    27Monitor

    The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name

    MediumCVSS 5.0No exploitEPSS 22%

    microsoft · windows 2003 serverFeb 8, 2011

  • CVE-2011-0921
    43Plan

    crs.exe in the Cell Manager Service in the client in HP Data Protector does not properly validate credentials associated with the hostname,

    CriticalCVSS 10.0No exploitEPSS 11%

    hp · data protectorFeb 8, 2011

  • CVE-2011-0922
    59Plan

    The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share

    CriticalCVSS 10.0WeaponizedEPSS 64%

    hp · data protectorFeb 8, 2011

  • CVE-2011-0923
    64This week

    The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl code

    CriticalCVSS 10.0WeaponizedEPSS 81%

    hp · data protectorFeb 8, 2011

  • CVE-2011-0033
    43Plan

    The OpenType Compact Font Format (CFF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windo

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · windows 2003 serverFeb 10, 2011

  • CVE-2011-0035
    43Plan

    Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 10, 2011

  • CVE-2011-0036
    43Plan

    Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 10, 2011

  • CVE-2011-0038
    40Plan

    Untrusted search path vulnerability in Microsoft Internet Explorer 8 might allow local users to gain privileges via a Trojan horse IEShims.d

    CriticalCVSS 9.3No exploitEPSS 11%

    microsoft · internet explorerFeb 10, 2011

  • CVE-2011-0092
    44Plan

    The LZW stream decompression functionality in ORMELEMS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2 allows remote attackers to ex

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · visioFeb 10, 2011

  • CVE-2011-0093
    43Plan

    ELEMENTS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2 does not properly parse structures during the opening of a Visio file, whic

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · visioFeb 10, 2011

  • CVE-2011-0567
    49Plan

    AcroRd32.dll in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote att

    CriticalCVSS 9.3No exploitEPSS 40%

    adobe · acrobat readerFeb 10, 2011

  • CVE-2011-0591
    51Plan

    Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execut

    CriticalCVSS 9.3No exploitEPSS 47%

    adobe · acrobat readerFeb 10, 2011

  • CVE-2011-0592
    51Plan

    Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execut

    CriticalCVSS 9.3No exploitEPSS 47%

    adobe · acrobat readerFeb 10, 2011

  • CVE-2011-0593
    52Plan

    Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execut

    CriticalCVSS 9.3No exploitEPSS 49%

    adobe · acrobat readerFeb 10, 2011

  • CVE-2011-0600
    49Plan

    The U3D component in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remot

    CriticalCVSS 9.3No exploitEPSS 40%

    adobe · acrobat readerFeb 10, 2011

  • CVE-2011-0647
    59Plan

    The irccd.exe service in EMC Replication Manager Client before 5.3 and NetWorker Module for Microsoft Applications 2.1.x and 2.2.x allows re

    CriticalCVSS 10.0WeaponizedEPSS 63%

    emc · replication managerFeb 10, 2011

  • CVE-2011-0976
    45Plan

    Microsoft PowerPoint 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Compatib

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · powerpointFeb 10, 2011

  • CVE-2011-0977
    47Plan

    Use-after-free vulnerability in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2004 and 2008 for Mac, and Open XML File F

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · excelFeb 10, 2011

  • CVE-2011-0978
    50Plan

    Stack-based buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibi

    CriticalCVSS 9.3Proof of conceptEPSS 42%

    microsoft · excelFeb 10, 2011

  • CVE-2011-0979
    45Plan

    Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; and Exc

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · excelFeb 10, 2011

  • CVE-2011-0980
    45Plan

    Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse Office

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · excelFeb 10, 2011

  • CVE-2011-0654
    60This week

    Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser

    CriticalCVSS 10.0WeaponizedEPSS 68%

    microsoft · windows 2003 serverFeb 15, 2011

  • CVE-2010-4740
    49Plan

    Stack-based buffer overflow in WTclient.dll in SCADA Engine BACnet OPC Client before 1.0.25 allows user-assisted remote attackers to execute

    CriticalCVSS 9.3WeaponizedEPSS 41%

    scadaengine · bacnet opc clientFeb 15, 2011

  • CVE-2010-3274
    23Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Pl

    MediumCVSS 4.3Proof of conceptEPSS 21%

    zohocorp · manageengine adselfservice plusFeb 17, 2011

  • CVE-2010-4452
    65This week

    Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23

    CriticalCVSS 10.0WeaponizedEPSS 83%

    sun · jreFeb 17, 2011

  • CVE-2010-4476
    27Monitor

    The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update

    MediumCVSS 5.0Proof of conceptEPSS 23%

    sun · jreFeb 17, 2011

  • CVE-2010-4741
    45Plan

    Stack-based buffer overflow in MDMUtil.dll in MDMTool.exe in MDM Tool before 2.3 in Moxa Device Manager allows remote MDM Gateways to execut

    CriticalCVSS 9.3WeaponizedEPSS 27%

    moxa · device managerFeb 18, 2011

  • CVE-2010-4742
    57Plan

    Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5 in the Moxa ActiveX SDK allows remote attackers to e

    CriticalCVSS 10.0WeaponizedEPSS 56%

    moxa · activex sdkFeb 18, 2011

  • CVE-2010-4328
    35Monitor

    Multiple stack-based buffer overflows in opt/novell/iprint/bin/ipsmd in Novell iPrint for Linux Open Enterprise Server 2 SP2 and SP3 allow r

    HighCVSS 7.5Proof of conceptEPSS 15%

    novell · iprint open enterprise serverFeb 18, 2011

  • CVE-2011-0013
    20Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and

    MediumCVSS 4.3No exploitEPSS 10%

    apache · tomcatFeb 18, 2011

  • CVE-2011-0364
    46Plan

    The Management Console (webagent.exe) in Cisco Security Agent 5.1, 5.2, and 6.0 before 6.0.2.145 allows remote attackers to create arbitrary

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    cisco · security agentFeb 18, 2011

  • CVE-2011-0420
    24Monitor

    The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows context-dependent attackers to cause

    MediumCVSS 5.0Proof of conceptEPSS 14%

    php · phpFeb 18, 2011

  • CVE-2011-1002
    29Monitor

    avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty

    MediumCVSS 5.0No exploitEPSS 29%

    avahi · avahiFeb 22, 2011

  • CVE-2011-0414
    32Monitor

    ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock

    HighCVSS 7.1No exploitEPSS 13%

    isc · bindFeb 23, 2011

  • CVE-2010-4227
    45Plan

    The xdrDecodeString function in XNFS.NLM in Novell Netware 6.5 before SP8 allows remote attackers to cause a denial of service (abend) or ex

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    novell · netwareFeb 25, 2011

  • CVE-2011-1018
    45Plan

    logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstr

    CriticalCVSS 10.0Proof of conceptEPSS 18%

    logwatch · logwatchFeb 25, 2011