Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2011

25 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2011-0762
    40Plan

    The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU c

    MediumCVSS 4.0WeaponizedEPSS 73%

    vsftpd project · vsftpdMar 2, 2011

  • CVE-2011-1140
    40Plan

    Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.

    MediumCVSS 4.3WeaponizedEPSS 13%

    wireshark · wiresharkMar 2, 2011

  • CVE-2009-3028
    40Plan

    The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification

    MediumCVSS 6.8WeaponizedEPSS 42%

    symantec · altiris deployment solutionMar 7, 2011

  • CVE-2011-0032
    40Plan

    Untrusted search path vulnerability in DirectShow in Microsoft Windows Vista SP1 and SP2, Windows 7 Gold and SP1, Windows Server 2008 R2 and

    CriticalCVSS 9.3No exploitEPSS 10%

    microsoft · windows 7Mar 9, 2011

  • CVE-2011-0042
    41Plan

    SBE.dll in the Stream Buffer Engine in Windows Media Player and Windows Media Center in Microsoft Windows XP SP2 and SP3, Windows XP Media C

    HighCVSS 7.8No exploitEPSS 33%

    microsoft · windows xp media centerMar 9, 2011

  • CVE-2011-1345
    49Plan

    Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 40%

    microsoft · internet explorerMar 10, 2011

  • CVE-2011-1346
    45Plan

    Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vector

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · internet explorerMar 10, 2011

  • CVE-2011-1347
    43Plan

    Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to bypass Protected Mode and create arbitrar

    HighCVSS 8.8No exploitEPSS 27%

    microsoft · internet explorerMar 10, 2011

  • CVE-2010-3609
    25Monitor

    The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol

    MediumCVSS 5.0Proof of conceptEPSS 17%

    openslp · openslpMar 11, 2011

  • CVE-2011-1137
    28Monitor

    Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memor

    MediumCVSS 5.0Proof of conceptEPSS 28%

    proftpd · proftpdMar 11, 2011

  • CVE-2011-0063
    46Plan

    The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal a

    MediumCVSS 5.0WeaponizedEPSS 85%

    mj2 · majordomo 2Mar 15, 2011

  • CVE-2011-0609
    80Now

    Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on

    HighCVSS 7.8KEVWeaponizedEPSS 63%

    adobe · flash playerMar 15, 2011

  • CVE-2011-1092
    35Monitor

    Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possib

    HighCVSS 7.5Proof of conceptEPSS 17%

    php · phpMar 15, 2011

  • CVE-2011-0411
    32Monitor

    The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properl

    MediumCVSS 6.8No exploitEPSS 16%

    postfix · postfixMar 16, 2011

  • CVE-2011-0889
    44Plan

    Unspecified vulnerability in HP Client Automation Enterprise (aka HPCA or Radia Notify) 5.11, 7.2, 7.5, 7.8, and 7.9 allows remote attackers

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · client automation enterpriseMar 16, 2011

  • CVE-2011-0421
    21Monitor

    The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHAN

    MediumCVSS 4.3Proof of conceptEPSS 13%

    php · phpMar 19, 2011

  • CVE-2011-1081
    24Monitor

    modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Disting

    MediumCVSS 5.0Proof of conceptEPSS 14%

    openldap · openldapMar 19, 2011

  • CVE-2011-1467
    24Monitor

    Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allow

    MediumCVSS 5.0Proof of conceptEPSS 12%

    php · phpMar 19, 2011

  • CVE-2011-1468
    21Monitor

    Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consump

    MediumCVSS 4.3Proof of conceptEPSS 13%

    php · phpMar 19, 2011

  • CVE-2011-1471
    21Monitor

    Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of se

    MediumCVSS 4.3Proof of conceptEPSS 13%

    php · phpMar 19, 2011

  • CVE-2010-4228
    40Plan

    Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute ar

    CriticalCVSS 9.0Proof of conceptEPSS 14%

    novell · netwareMar 22, 2011

  • CVE-2010-3275
    60This week

    libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an

    CriticalCVSS 9.3WeaponizedEPSS 75%

    videolan · vlc media playerMar 28, 2011

  • CVE-2010-1674
    24Monitor

    The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereferenc

    MediumCVSS 5.0No exploitEPSS 13%

    quagga · quaggaMar 29, 2011

  • CVE-2011-0764
    31Monitor

    t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereferenc

    MediumCVSS 6.8No exploitEPSS 13%

    t1lib · t1libMar 31, 2011

  • CVE-2011-1552
    20Monitor

    t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote

    MediumCVSS 4.3No exploitEPSS 10%

    t1lib · t1libMar 31, 2011