By publication date

Exploited and new serious CVEs: April 2011

48 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2011-0951Weaponized	The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remotecisco · secure access control system · CWE-255 Pre-auth	Medium5.0	—	14.6%	Apr 4, 2011
62This week	CVE-2011-1563Weaponized	Multiple stack-based buffer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackrealflex · realwin · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	74.6%	Apr 5, 2011
46Plan	CVE-2011-1564Proof of concept	Multiple integer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execrealflex · realwin · CWE-189 pre-auth RCE	Critical10.0	—	18.6%	Apr 5, 2011
59Plan	CVE-2011-1565Weaponized	Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS7t · igss · CWE-22 Pre-auth Path traversal	Critical10.0	—	64.0%	Apr 5, 2011
60This week	CVE-2011-1566Weaponized	Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows rem7t · igss · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	66.9%	Apr 5, 2011
61This week	CVE-2011-1567Weaponized	Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (7t · igss · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	69.6%	Apr 5, 2011
46Plan	CVE-2011-1568Proof of concept	Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and 9.00.00.11063 and earlier, in 7t · igss · CWE-134 pre-auth RCE	Critical10.0	—	19.3%	Apr 5, 2011
41Plan	CVE-2011-1525Proof of concept	Heap-based buffer overflow in rvrender.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2, and RealPlayer SP 1.0 thrrealnetworks · realplayer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	11.9%	Apr 6, 2011
24Monitor	CVE-2011-1652No exploit	The default configuration of Microsoft Windows 7 immediately prefers a new IPv6 and DHCPv6 service over a currently used IPv4 and DHCPv4 sermicrosoft · windows 7 · CWE-16 Pre-auth	Medium5.0	—	12.3%	Apr 6, 2011
55Plan	CVE-2011-0997No exploit	dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers tisc · dhcp · CWE-20 pre-auth RCE	High7.5	—	84.5%	Apr 8, 2011
24Monitor	CVE-2011-1071Proof of concept	The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary codegnu · eglibc · CWE-399 pre-auth RCE	Medium5.1	—	14.3%	Apr 8, 2011
27Monitor	CVE-2011-1669Proof of concept	Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbwordpress · wordpress · CWE-22 Pre-auth Path traversal	Medium5.0	—	22.1%	Apr 9, 2011
45Plan	CVE-2011-0994No exploit	Stack-based buffer overflow in NFRAgent.exe in Novell File Reporter (NFR) before 1.0.2 allows remote attackers to execute arbitrary code vianovell · file reporter · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	17.9%	Apr 9, 2011
23Monitor	CVE-2011-1487Proof of concept	The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, doperl · perl · CWE-264 Pre-auth	Medium5.0	—	10.5%	Apr 11, 2011
95Now	CVE-2011-0611Weaponized	Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.adobe · flash player · CWE-843 pre-auth RCE	High8.8	KEV	99.4%	Apr 13, 2011
44Plan	CVE-2010-3958No exploit	The x86 JIT compiler in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 does not properly compile function calls, which allows remmicrosoft · .net framework · CWE-20 pre-auth RCE	Critical9.3	—	23.5%	Apr 13, 2011
36Monitor	CVE-2010-3974No exploit	fxscover.exe in the Fax Cover Page Editor in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Smicrosoft · windows 2003 server · CWE-119 pre-auth RCE Memory safety	High7.6	—	18.5%	Apr 13, 2011
44Plan	CVE-2011-0028No exploit	WordPad in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly parse fields in Word documents, which allows remote attackmicrosoft · windows server 2003 · CWE-94 pre-auth RCE	Critical9.3	—	23.5%	Apr 13, 2011
45Plan	CVE-2011-0034No exploit	Stack-based buffer overflow in the OpenType Compact Font Format (aka OTF or CFF) driver in Microsoft Windows XP SP2 and SP3, Windows Server microsoft · windows 2003 server · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	27.9%	Apr 13, 2011
45Plan	CVE-2011-0041Proof of concept	Integer overflow in gdiplus.dll in GDI+ in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Sermicrosoft · windows 2003 server · CWE-189 pre-auth RCE	Critical9.3	—	28.1%	Apr 13, 2011
44Plan	CVE-2011-0094No exploit	Use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code by accessing an objectmicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	21.9%	Apr 13, 2011
46Plan	CVE-2011-0097No exploit	Integer underflow in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter fomicrosoft · excel · CWE-189 pre-auth RCE	Critical9.3	—	31.5%	Apr 13, 2011
46Plan	CVE-2011-0098No exploit	Integer signedness error in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Convemicrosoft · excel · CWE-189 pre-auth RCE	Critical9.3	—	30.4%	Apr 13, 2011
46Plan	CVE-2011-0101No exploit	Microsoft Excel 2002 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Remicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	29.9%	Apr 13, 2011
45Plan	CVE-2011-0103No exploit	Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to exmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.4%	Apr 13, 2011
53Plan	CVE-2011-0104Proof of concept	Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to exmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	53.4%	Apr 13, 2011
58Plan	CVE-2011-0105Weaponized	Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an unimicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	70.1%	Apr 13, 2011
40Plan	CVE-2011-0107No exploit	Untrusted search path vulnerability in Microsoft Office XP SP3, Office 2003 SP3, and Office 2007 SP2 allows local users to gain privileges vmicrosoft · office Pre-auth	Critical9.3	—	11.1%	Apr 13, 2011
44Plan	CVE-2011-0655No exploit	Microsoft PowerPoint 2007 SP2 and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pamicrosoft · office · CWE-20 pre-auth RCE	Critical9.3	—	22.5%	Apr 13, 2011
46Plan	CVE-2011-0656No exploit	Microsoft PowerPoint 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Ofmicrosoft · office · CWE-20 pre-auth RCE	Critical9.3	—	29.6%	Apr 13, 2011
60This week	CVE-2011-0657Weaponized	DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gomicrosoft · windows 2003 server · CWE-20 pre-auth RCE	Critical9.8	—	62.4%	Apr 13, 2011
42Plan	CVE-2011-0660No exploit	The SMB client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, amicrosoft · windows 7 · CWE-20 pre-auth RCE	Critical9.3	—	16.6%	Apr 13, 2011
53Plan	CVE-2011-0661No exploit	The SMB Server service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SPmicrosoft · windows 2003 server · CWE-20 pre-auth RCE	Critical10.0	—	44.5%	Apr 13, 2011
43Plan	CVE-2011-0663No exploit	Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attamicrosoft · jscript · CWE-189 pre-auth RCE	High8.8	—	26.2%	Apr 13, 2011
46Plan	CVE-2011-1243No exploit	The Windows Messenger ActiveX control in msgsc.dll in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code viamicrosoft · windows xp · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	29.3%	Apr 13, 2011
28Monitor	CVE-2011-1244No exploit	Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obmicrosoft · internet explorer · CWE-1021 Pre-auth	Medium5.8	—	15.1%	Apr 13, 2011
22Monitor	CVE-2011-1245No exploit	Microsoft Internet Explorer 6 and 7 does not properly restrict script access to content from a (1) different domain or (2) different zone, wmicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	16.7%	Apr 13, 2011
46Plan	CVE-2011-0285Proof of concept	The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 mit · kerberos 5 · CWE-20 pre-auth RCE	Critical10.0	—	20.7%	Apr 14, 2011
20Monitor	CVE-2011-1713No exploit	Microsoft msxml.dll, as used in Internet Explorer 8 on Windows 7, allows remote attackers to obtain potentially sensitive information about microsoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	11.1%	Apr 15, 2011
67This week	CVE-2011-1653Weaponized	Multiple SQL injection vulnerabilities in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 allow remote attabroadcom · total defense · CWE-89 pre-auth RCE SQL injection	Critical10.0	—	88.6%	Apr 18, 2011
33Monitor	CVE-2011-1654No exploit	Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defensbroadcom · total defense · CWE-22 pre-auth RCE Path traversal	High7.5	—	11.4%	Apr 18, 2011
34Monitor	CVE-2011-1655No exploit	The management.asmx module in the Management Web Service in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2broadcom · total defense · CWE-310 pre-auth RCE	High7.5	—	11.9%	Apr 18, 2011
48Plan	CVE-2010-4229No exploit	Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworksnovell · zenworks configuration management · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	25.4%	Apr 18, 2011
58Plan	CVE-2011-0807Weaponized	Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, alloworacle · glassfish server Pre-auth	Critical10.0	—	60.8%	Apr 19, 2011
45Plan	CVE-2011-1206Proof of concept	Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6ibm · tivoli directory server · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	15.7%	Apr 21, 2011
41Plan	CVE-2011-1719No exploit	Multiple stack-based buffer overflows in the Web Viewer ActiveX controls in CA Output Management Web Viewer 11.0 and 11.5 allow remote attacbroadcom · output management web viewer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	12.0%	Apr 26, 2011
44Plan	CVE-2011-1541No exploit	Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote attackers to bypass intended access restrictions, hp · system management homepage pre-auth RCE	Critical10.0	—	12.1%	Apr 29, 2011
50Plan	CVE-2011-1591Weaponized	Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers twireshark · wireshark · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	41.7%	Apr 29, 2011

CVE-2011-0951
40Plan
The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote
MediumCVSS 5.0WeaponizedEPSS 14%
- Pre-auth
cisco · secure access control systemApr 4, 2011
CVE-2011-1563
62This week
Multiple stack-based buffer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attack
CriticalCVSS 10.0WeaponizedEPSS 74%
- pre-auth RCE
- Memory safety
realflex · realwinApr 5, 2011
CVE-2011-1564
46Plan
Multiple integer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to exec
CriticalCVSS 10.0Proof of conceptEPSS 18%
- pre-auth RCE
realflex · realwinApr 5, 2011
CVE-2011-1565
59Plan
Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS
CriticalCVSS 10.0WeaponizedEPSS 64%
- Pre-auth
- Path traversal
7t · igssApr 5, 2011
CVE-2011-1566
60This week
Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows rem
CriticalCVSS 10.0WeaponizedEPSS 66%
- pre-auth RCE
- Path traversal
7t · igssApr 5, 2011
CVE-2011-1567
61This week
Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (
CriticalCVSS 10.0WeaponizedEPSS 69%
- pre-auth RCE
- Memory safety
7t · igssApr 5, 2011
CVE-2011-1568
46Plan
Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and 9.00.00.11063 and earlier, in
CriticalCVSS 10.0Proof of conceptEPSS 19%
- pre-auth RCE
7t · igssApr 5, 2011
CVE-2011-1525
41Plan
Heap-based buffer overflow in rvrender.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2, and RealPlayer SP 1.0 thr
CriticalCVSS 9.3Proof of conceptEPSS 11%
- pre-auth RCE
- Memory safety
realnetworks · realplayerApr 6, 2011
CVE-2011-1652
24Monitor
The default configuration of Microsoft Windows 7 immediately prefers a new IPv6 and DHCPv6 service over a currently used IPv4 and DHCPv4 ser
MediumCVSS 5.0No exploitEPSS 12%
- Pre-auth
microsoft · windows 7Apr 6, 2011
CVE-2011-0997
55Plan
dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers t
HighCVSS 7.5No exploitEPSS 84%
- pre-auth RCE
isc · dhcpApr 8, 2011
CVE-2011-1071
24Monitor
The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code
MediumCVSS 5.1Proof of conceptEPSS 14%
- pre-auth RCE
gnu · eglibcApr 8, 2011
CVE-2011-1669
27Monitor
Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arb
MediumCVSS 5.0Proof of conceptEPSS 22%
- Pre-auth
- Path traversal
wordpress · wordpressApr 9, 2011
CVE-2011-0994
45Plan
Stack-based buffer overflow in NFRAgent.exe in Novell File Reporter (NFR) before 1.0.2 allows remote attackers to execute arbitrary code via
CriticalCVSS 10.0No exploitEPSS 17%
- pre-auth RCE
- Memory safety
novell · file reporterApr 9, 2011
CVE-2011-1487
23Monitor
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do
MediumCVSS 5.0Proof of conceptEPSS 10%
- Pre-auth
perl · perlApr 11, 2011
CVE-2011-0611
95Now
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.
HighCVSS 8.8KEVWeaponizedEPSS 99%
- pre-auth RCE
adobe · flash playerApr 13, 2011
CVE-2010-3958
44Plan
The x86 JIT compiler in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 does not properly compile function calls, which allows rem
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · .net frameworkApr 13, 2011
CVE-2010-3974
36Monitor
fxscover.exe in the Fax Cover Page Editor in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows S
HighCVSS 7.6No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · windows 2003 serverApr 13, 2011
CVE-2011-0028
44Plan
WordPad in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly parse fields in Word documents, which allows remote attack
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · windows server 2003Apr 13, 2011
CVE-2011-0034
45Plan
Stack-based buffer overflow in the OpenType Compact Font Format (aka OTF or CFF) driver in Microsoft Windows XP SP2 and SP3, Windows Server
CriticalCVSS 9.3No exploitEPSS 27%
- pre-auth RCE
- Memory safety
microsoft · windows 2003 serverApr 13, 2011
CVE-2011-0041
45Plan
Integer overflow in gdiplus.dll in GDI+ in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Ser
CriticalCVSS 9.3Proof of conceptEPSS 28%
- pre-auth RCE
microsoft · windows 2003 serverApr 13, 2011
CVE-2011-0094
44Plan
Use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code by accessing an object
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
microsoft · internet explorerApr 13, 2011
CVE-2011-0097
46Plan
Integer underflow in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter fo
CriticalCVSS 9.3No exploitEPSS 31%
- pre-auth RCE
microsoft · excelApr 13, 2011
CVE-2011-0098
46Plan
Integer signedness error in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Conve
CriticalCVSS 9.3No exploitEPSS 30%
- pre-auth RCE
microsoft · excelApr 13, 2011
CVE-2011-0101
46Plan
Microsoft Excel 2002 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Re
CriticalCVSS 9.3No exploitEPSS 29%
- pre-auth RCE
- Memory safety
microsoft · excelApr 13, 2011
CVE-2011-0103
45Plan
Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to ex
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · excelApr 13, 2011
CVE-2011-0104
53Plan
Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to ex
CriticalCVSS 9.3Proof of conceptEPSS 53%
- pre-auth RCE
- Memory safety
microsoft · excelApr 13, 2011
CVE-2011-0105
58Plan
Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uni
CriticalCVSS 9.3WeaponizedEPSS 70%
- pre-auth RCE
- Memory safety
microsoft · excelApr 13, 2011
CVE-2011-0107
40Plan
Untrusted search path vulnerability in Microsoft Office XP SP3, Office 2003 SP3, and Office 2007 SP2 allows local users to gain privileges v
CriticalCVSS 9.3No exploitEPSS 11%
- Pre-auth
microsoft · officeApr 13, 2011
CVE-2011-0655
44Plan
Microsoft PowerPoint 2007 SP2 and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pa
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · officeApr 13, 2011
CVE-2011-0656
46Plan
Microsoft PowerPoint 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Of
CriticalCVSS 9.3No exploitEPSS 29%
- pre-auth RCE
microsoft · officeApr 13, 2011
CVE-2011-0657
60This week
DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Go
CriticalCVSS 9.8WeaponizedEPSS 62%
- pre-auth RCE
microsoft · windows 2003 serverApr 13, 2011
CVE-2011-0660
42Plan
The SMB client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, a
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
microsoft · windows 7Apr 13, 2011
CVE-2011-0661
53Plan
The SMB Server service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP
CriticalCVSS 10.0No exploitEPSS 44%
- pre-auth RCE
microsoft · windows 2003 serverApr 13, 2011
CVE-2011-0663
43Plan
Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote atta
HighCVSS 8.8No exploitEPSS 26%
- pre-auth RCE
microsoft · jscriptApr 13, 2011
CVE-2011-1243
46Plan
The Windows Messenger ActiveX control in msgsc.dll in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via
CriticalCVSS 9.3No exploitEPSS 29%
- pre-auth RCE
- Memory safety
microsoft · windows xpApr 13, 2011
CVE-2011-1244
28Monitor
Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to ob
MediumCVSS 5.8No exploitEPSS 15%
- Pre-auth
microsoft · internet explorerApr 13, 2011
CVE-2011-1245
22Monitor
Microsoft Internet Explorer 6 and 7 does not properly restrict script access to content from a (1) different domain or (2) different zone, w
MediumCVSS 4.3No exploitEPSS 16%
- Pre-auth
- Info leak
microsoft · internet explorerApr 13, 2011
CVE-2011-0285
46Plan
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9
CriticalCVSS 10.0Proof of conceptEPSS 20%
- pre-auth RCE
mit · kerberos 5Apr 14, 2011
CVE-2011-1713
20Monitor
Microsoft msxml.dll, as used in Internet Explorer 8 on Windows 7, allows remote attackers to obtain potentially sensitive information about
MediumCVSS 4.3No exploitEPSS 11%
- Pre-auth
- Info leak
microsoft · internet explorerApr 15, 2011
CVE-2011-1653
67This week
Multiple SQL injection vulnerabilities in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 allow remote atta
CriticalCVSS 10.0WeaponizedEPSS 88%
- pre-auth RCE
- SQL injection
broadcom · total defenseApr 18, 2011
CVE-2011-1654
33Monitor
Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defens
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Path traversal
broadcom · total defenseApr 18, 2011
CVE-2011-1655
34Monitor
The management.asmx module in the Management Web Service in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
broadcom · total defenseApr 18, 2011
CVE-2010-4229
48Plan
Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks
CriticalCVSS 10.0No exploitEPSS 25%
- pre-auth RCE
- Path traversal
novell · zenworks configuration managementApr 18, 2011
CVE-2011-0807
58Plan
Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allow
CriticalCVSS 10.0WeaponizedEPSS 60%
- Pre-auth
oracle · glassfish serverApr 19, 2011
CVE-2011-1206
45Plan
Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6
CriticalCVSS 10.0Proof of conceptEPSS 15%
- pre-auth RCE
- Memory safety
ibm · tivoli directory serverApr 21, 2011
CVE-2011-1719
41Plan
Multiple stack-based buffer overflows in the Web Viewer ActiveX controls in CA Output Management Web Viewer 11.0 and 11.5 allow remote attac
CriticalCVSS 9.3No exploitEPSS 12%
- pre-auth RCE
- Memory safety
broadcom · output management web viewerApr 26, 2011
CVE-2011-1541
44Plan
Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote attackers to bypass intended access restrictions,
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
hp · system management homepageApr 29, 2011
CVE-2011-1591
50Plan
Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers t
CriticalCVSS 9.3WeaponizedEPSS 41%
- pre-auth RCE
- Memory safety
wireshark · wiresharkApr 29, 2011