Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2011

43 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2011-1844
    35Monitor

    Memory leak in Microsoft Silverlight 4 before 4.0.60310.0 allows remote attackers to cause a denial of service (memory consumption) via an a

    HighCVSS 7.8No exploitEPSS 12%

    microsoft · silverlightMay 3, 2011

  • CVE-2011-1845
    35Monitor

    Multiple memory leaks in the DataGrid control implementation in Microsoft Silverlight 4 before 4.0.60310.0 allow remote attackers to cause a

    HighCVSS 7.8No exploitEPSS 12%

    microsoft · silverlightMay 3, 2011

  • CVE-2009-5022
    30Monitor

    Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via

    MediumCVSS 6.8Proof of conceptEPSS 10%

    libtiff · libtiffMay 3, 2011

  • CVE-2011-1609
    40Plan

    SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)

    HighCVSS 8.5Proof of conceptEPSS 19%

    cisco · unified communications managerMay 3, 2011

  • CVE-2011-1610
    32Monitor

    Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications

    MediumCVSS 6.4No exploitEPSS 24%

    cisco · unified communications managerMay 3, 2011

  • CVE-2011-1613
    34Monitor

    Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 6.0 before 6.0.200.0, 7.0 before 7.0.98.216, and 7.0.1xx before 7.

    HighCVSS 7.8Proof of conceptEPSS 10%

    cisco · wireless lan controller softwareMay 3, 2011

  • CVE-2011-0340
    47Plan

    Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as d

    CriticalCVSS 9.3WeaponizedEPSS 32%

    advantech · advantech studioMay 4, 2011

  • CVE-2011-1900
    50Plan

    Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 6.1 and 7.x before 7.0+Patch 1 allows remote attackers to execute ar

    CriticalCVSS 10.0WeaponizedEPSS 32%

    indusoft · web studioMay 4, 2011

  • CVE-2011-0065
    62This week

    Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers

    CriticalCVSS 10.0WeaponizedEPSS 73%

    mozilla · firefoxMay 7, 2011

  • CVE-2011-0073
    61This week

    Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which

    CriticalCVSS 10.0WeaponizedEPSS 70%

    mozilla · firefoxMay 7, 2011

  • CVE-2011-1728
    44Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1729
    44Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1730
    44Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1731
    44Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 14%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1732
    47Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 24%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1733
    44Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1734
    44Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 14%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1735
    44Plan

    Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows r

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · openview storage data protectorMay 7, 2011

  • CVE-2011-1574
    40Plan

    Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute arbitrary

    MediumCVSS 6.8WeaponizedEPSS 42%

    konstanty bialkowski · libmodplugMay 9, 2011

  • CVE-2011-1271
    36Monitor

    The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handl

    HighCVSS 7.7Proof of conceptEPSS 20%

    microsoft · .net frameworkMay 10, 2011

  • CVE-2011-1248
    51Plan

    WINS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 does not properly handle socket send exceptions, which a

    CriticalCVSS 9.3Proof of conceptEPSS 47%

    microsoft · windows server 2003May 13, 2011

  • CVE-2011-1269
    41Plan

    Microsoft PowerPoint 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; and Office Comp

    CriticalCVSS 9.3No exploitEPSS 14%

    microsoft · officeMay 13, 2011

  • CVE-2011-1270
    42Plan

    Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint doc

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · powerpointMay 13, 2011

  • CVE-2011-1720
    33Monitor

    The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentic

    MediumCVSS 6.8No exploitEPSS 21%

    postfix · postfixMay 13, 2011

  • CVE-2011-1772
    20Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWo

    LowCVSS 2.6Proof of conceptEPSS 33%

    apache · strutsMay 13, 2011

  • CVE-2011-1848
    44Plan

    Stack-based buffer overflow in img.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbi

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · intelligent management centerMay 13, 2011

  • CVE-2011-1849
    43Plan

    tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to create or overwrite files, and subse

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · intelligent management centerMay 13, 2011

  • CVE-2011-1850
    44Plan

    Stack-based buffer overflow in the logging functionality in dbman.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows r

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · intelligent management centerMay 13, 2011

  • CVE-2011-1851
    44Plan

    Stack-based buffer overflow in tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execu

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · intelligent management centerMay 13, 2011

  • CVE-2011-1852
    45Plan

    Multiple stack-based buffer overflows in tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allow remote attackers

    CriticalCVSS 10.0No exploitEPSS 15%

    hp · intelligent management centerMay 13, 2011

  • CVE-2011-1853
    43Plan

    tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a (1) lar

    CriticalCVSS 10.0No exploitEPSS 11%

    hp · intelligent management centerMay 13, 2011

  • CVE-2011-1854
    43Plan

    Use-after-free vulnerability in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code

    CriticalCVSS 10.0No exploitEPSS 11%

    hp · intelligent management centerMay 13, 2011

  • CVE-2011-2089
    48Plan

    Stack-based buffer overflow in the SetActiveXGUID method in the VersionInfo ActiveX control in GenVersion.dll 8.0.138.0 in the WebHMI subsys

    CriticalCVSS 9.3WeaponizedEPSS 38%

    iconics · bizvizMay 13, 2011

  • CVE-2011-0419
    26Monitor

    Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and

    MediumCVSS 4.3Proof of conceptEPSS 30%

    apache · portable runtimeMay 16, 2011

  • CVE-2011-0614
    41Plan

    Buffer overflow in Adobe Audition 3.0.1 and earlier allows remote attackers to cause a denial of service (memory corruption and application

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    adobe · auditionMay 16, 2011

  • CVE-2011-0959
    23Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject a

    MediumCVSS 4.3Proof of conceptEPSS 21%

    cisco · unified operations managerMay 20, 2011

  • CVE-2011-0966
    39Monitor

    Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier

    MediumCVSS 6.8Proof of conceptEPSS 41%

    cisco · ciscoworks common servicesMay 20, 2011

  • CVE-2011-1575
    33Monitor

    The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-mid

    MediumCVSS 5.8Proof of conceptEPSS 33%

    pureftpd · pure-ftpdMay 23, 2011

  • CVE-2011-1928
    20Monitor

    The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18,

    MediumCVSS 4.3No exploitEPSS 10%

    apache · apr-utilMay 24, 2011

  • CVE-2011-1213
    47Plan

    Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrar

    CriticalCVSS 9.3WeaponizedEPSS 32%

    ibm · lotus notesMay 31, 2011

  • CVE-2011-1485
    40Plan

    Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a

    MediumCVSS 6.9WeaponizedEPSS 5%

    redhat · policykitMay 31, 2011

  • CVE-2011-1910
    27Monitor

    Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R

    MediumCVSS 5.0No exploitEPSS 24%

    isc · bindMay 31, 2011

  • CVE-2011-1938
    37Monitor

    Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent

    HighCVSS 7.5Proof of conceptEPSS 23%

    php · phpMay 31, 2011