By publication date

Exploited and new serious CVEs: June 2011

46 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
51Plan	CVE-2011-2039Weaponized	The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windowscisco · anyconnect secure mobility client · CWE-20 pre-auth RCE	High7.6	—	69.9%	Jun 2, 2011
40Plan	CVE-2011-2040No exploit	The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629cisco · anyconnect secure mobility client · CWE-20 pre-auth RCE	Critical9.3	—	10.6%	Jun 2, 2011
55Plan	CVE-2011-1220Weaponized	Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 allows remote autibm · tivoli management framework · CWE-119 RCE Memory safety	Critical9.0	—	62.6%	Jun 2, 2011
44Plan	CVE-2011-2331No exploit	Integer overflow in img.exe in HP Intelligent Management Center (IMC) allows remote attackers to execute arbitrary code via a crafted lengthhp · intelligent management center · CWE-189 pre-auth RCE	Critical10.0	—	13.3%	Jun 2, 2011
23Monitor	CVE-2011-2382No exploit	Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which microsoft · ie · CWE-20 Pre-auth	Medium4.3	—	19.3%	Jun 3, 2011
23Monitor	CVE-2011-2383No exploit	Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attmicrosoft · ie · CWE-20 Pre-auth	Medium4.3	—	20.8%	Jun 3, 2011
50Plan	CVE-2011-2217Weaponized	Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Cltomsawyer · get extension factory · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	41.9%	Jun 6, 2011
51Plan	CVE-2011-2386Weaponized	VisiWaveReport.exe in AZO Technologies, Inc.visiwave · site survey · CWE-94 pre-auth RCE	Critical9.3	—	45.2%	Jun 8, 2011
40Plan	CVE-2010-4804Weaponized	The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) Bgoogle · android · CWE-200 Pre-auth Info leak	Medium4.3	—	26.9%	Jun 9, 2011
73This week	CVE-2011-1823Weaponized	The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows google · android · CWE-190 RCE Local privilege escalation Memory safety	High7.8	KEV	41.3%	Jun 9, 2011
40Plan	CVE-2011-2474Weaponized	Directory traversal vulnerability in the HTTP Server in Sybase EAServer 6.3.1 Developer Edition allows remote attackers to read arbitrary fisybase · easerver · CWE-22 Pre-auth Path traversal	Medium5.0	—	63.6%	Jun 9, 2011
25Monitor	CVE-2011-2179Proof of concept	Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote aicinga · icinga · CWE-79 Pre-auth XSS	Medium4.3	—	26.0%	Jun 14, 2011
43Plan	CVE-2011-0658No exploit	Integer underflow in the OLE Automation protocol implementation in VBScript.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2microsoft · windows 2003 server · CWE-189 pre-auth RCE	Critical9.3	—	21.2%	Jun 16, 2011
42Plan	CVE-2011-0664No exploit	Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validatemicrosoft · .net framework · CWE-20 pre-auth RCE	Critical9.3	—	16.0%	Jun 16, 2011
43Plan	CVE-2011-1250No exploit	Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code microsoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	21.5%	Jun 16, 2011
42Plan	CVE-2011-1251No exploit	Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessimicrosoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	17.9%	Jun 16, 2011
28Monitor	CVE-2011-1252No exploit	Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office Shamicrosoft · internet explorer · CWE-79 Pre-auth XSS	Medium6.1	—	13.9%	Jun 16, 2011
42Plan	CVE-2011-1254No exploit	Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code microsoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	17.9%	Jun 16, 2011
50Plan	CVE-2011-1255Proof of concept	The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handmicrosoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	42.1%	Jun 16, 2011
43Plan	CVE-2011-1256No exploit	Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code microsoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	18.6%	Jun 16, 2011
21Monitor	CVE-2011-1258No exploit	Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitimicrosoft · internet explorer · CWE-668 Pre-auth	Medium4.3	—	14.6%	Jun 16, 2011
55Plan	CVE-2011-1260Weaponized	Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	60.8%	Jun 16, 2011
42Plan	CVE-2011-1261No exploit	Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code microsoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	16.9%	Jun 16, 2011
42Plan	CVE-2011-1262No exploit	Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code microsoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	16.9%	Jun 16, 2011
42Plan	CVE-2011-1266No exploit	The Vector Markup Language (VML) implementation in vgx.dll in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memicrosoft · internet explorer · CWE-908 pre-auth RCE Memory safety	Critical9.3	—	17.9%	Jun 16, 2011
38Monitor	CVE-2011-1267No exploit	The SMB server in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remomicrosoft · windows 7 · CWE-399 Pre-auth Denial of service	High7.8	—	24.1%	Jun 16, 2011
43Plan	CVE-2011-1268No exploit	The SMB client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, amicrosoft · windows 2003 server · CWE-20 pre-auth RCE	Critical10.0	—	10.7%	Jun 16, 2011
42Plan	CVE-2011-1272No exploit	Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; anmicrosoft · excel · CWE-20 pre-auth RCE	Critical9.3	—	17.5%	Jun 16, 2011
42Plan	CVE-2011-1273No exploit	Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Excel Vmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.9%	Jun 16, 2011
41Plan	CVE-2011-1274No exploit	Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; anmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.3%	Jun 16, 2011
41Plan	CVE-2011-1275No exploit	Microsoft Excel 2002 SP3; Office 2004, 2008, and 2011 for Mac; and Open XML File Format Converter for Mac do not properly validate record inmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.3%	Jun 16, 2011
45Plan	CVE-2011-1276Proof of concept	Buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Emicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	28.2%	Jun 16, 2011
42Plan	CVE-2011-1277No exploit	Microsoft Excel 2002 SP3, Office 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information duringmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.0%	Jun 16, 2011
42Plan	CVE-2011-1278No exploit	Microsoft Excel 2002 SP3 and Office 2004 for Mac do not properly validate record information during parsing of Excel spreadsheets, which allmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.9%	Jun 16, 2011
42Plan	CVE-2011-1279No exploit	Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate recmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.9%	Jun 16, 2011
22Monitor	CVE-2011-1280No exploit	The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio microsoft · office infopath · CWE-200 Pre-auth XXE Info leak	Medium4.3	—	15.2%	Jun 16, 2011
44Plan	CVE-2011-1868No exploit	The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate fields imicrosoft · windows 2003 server · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	14.3%	Jun 16, 2011
34Monitor	CVE-2011-1869No exploit	The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Wimicrosoft · windows 2003 server · CWE-399 Pre-auth Denial of service	High7.8	—	10.2%	Jun 16, 2011
43Plan	CVE-2011-1873No exploit	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gmicrosoft · windows 7 · CWE-20 pre-auth RCE	Critical9.3	—	18.7%	Jun 16, 2011
84Now	CVE-2011-1889Weaponized	The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execumicrosoft · forefront threat management gateway · CWE-119 pre-auth RCE Memory safety	Critical9.8	KEV	49.0%	Jun 16, 2011
20Monitor	CVE-2011-1894No exploit	The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Goldmicrosoft · windows 2003 server · CWE-79 Pre-auth XSS	Medium4.3	—	11.4%	Jun 16, 2011
42Plan	CVE-2011-2095No exploit	Buffer overflow in Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Windows and Mac OS X allows attackers adobe · acrobat reader · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.7%	Jun 16, 2011
66This week	CVE-2011-2110Weaponized	Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attackadobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	86.4%	Jun 16, 2011
31Monitor	CVE-2011-2202Proof of concept	The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST reqphp · php · CWE-264 Pre-auth Path traversal	Medium6.4	—	19.7%	Jun 16, 2011
32Monitor	CVE-2011-2600No exploit	The GPU support functionality in Windows XP does not properly restrict rendering time, which allows remote attackers to cause a denial of semicrosoft · windows xp · CWE-264 Pre-auth Denial of service	High7.1	—	11.7%	Jun 30, 2011
63This week	CVE-2011-2371Weaponized	Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMmozilla · seamonkey · CWE-189 pre-auth RCE	Critical10.0	—	75.6%	Jun 30, 2011

CVE-2011-2039
51Plan
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows
HighCVSS 7.6WeaponizedEPSS 69%
- pre-auth RCE
cisco · anyconnect secure mobility clientJun 2, 2011
CVE-2011-2040
40Plan
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
cisco · anyconnect secure mobility clientJun 2, 2011
CVE-2011-1220
55Plan
Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 allows remote aut
CriticalCVSS 9.0WeaponizedEPSS 62%
- RCE
- Memory safety
ibm · tivoli management frameworkJun 2, 2011
CVE-2011-2331
44Plan
Integer overflow in img.exe in HP Intelligent Management Center (IMC) allows remote attackers to execute arbitrary code via a crafted length
CriticalCVSS 10.0No exploitEPSS 13%
- pre-auth RCE
hp · intelligent management centerJun 2, 2011
CVE-2011-2382
23Monitor
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which
MediumCVSS 4.3No exploitEPSS 19%
- Pre-auth
microsoft · ieJun 3, 2011
CVE-2011-2383
23Monitor
Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote att
MediumCVSS 4.3No exploitEPSS 20%
- Pre-auth
microsoft · ieJun 3, 2011
CVE-2011-2217
50Plan
Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Cl
CriticalCVSS 9.3WeaponizedEPSS 41%
- pre-auth RCE
- Memory safety
tomsawyer · get extension factoryJun 6, 2011
CVE-2011-2386
51Plan
VisiWaveReport.exe in AZO Technologies, Inc.
CriticalCVSS 9.3WeaponizedEPSS 45%
- pre-auth RCE
visiwave · site surveyJun 8, 2011
CVE-2010-4804
40Plan
The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) B
MediumCVSS 4.3WeaponizedEPSS 26%
- Pre-auth
- Info leak
google · androidJun 9, 2011
CVE-2011-1823
73This week
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows
HighCVSS 7.8KEVWeaponizedEPSS 41%
- RCE
- Local privilege escalation
- Memory safety
google · androidJun 9, 2011
CVE-2011-2474
40Plan
Directory traversal vulnerability in the HTTP Server in Sybase EAServer 6.3.1 Developer Edition allows remote attackers to read arbitrary fi
MediumCVSS 5.0WeaponizedEPSS 63%
- Pre-auth
- Path traversal
sybase · easerverJun 9, 2011
CVE-2011-2179
25Monitor
Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote a
MediumCVSS 4.3Proof of conceptEPSS 26%
- Pre-auth
- XSS
icinga · icingaJun 14, 2011
CVE-2011-0658
43Plan
Integer underflow in the OLE Automation protocol implementation in VBScript.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
microsoft · windows 2003 serverJun 16, 2011
CVE-2011-0664
42Plan
Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validate
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
microsoft · .net frameworkJun 16, 2011
CVE-2011-1250
43Plan
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1251
42Plan
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1252
28Monitor
Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office Sha
MediumCVSS 6.1No exploitEPSS 13%
- Pre-auth
- XSS
microsoft · internet explorerJun 16, 2011
CVE-2011-1254
42Plan
Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1255
50Plan
The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly hand
CriticalCVSS 9.3Proof of conceptEPSS 42%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1256
43Plan
Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1258
21Monitor
Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensiti
MediumCVSS 4.3No exploitEPSS 14%
- Pre-auth
microsoft · internet explorerJun 16, 2011
CVE-2011-1260
55Plan
Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by a
CriticalCVSS 9.3WeaponizedEPSS 60%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1261
42Plan
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1262
42Plan
Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1266
42Plan
The Vector Markup Language (VML) implementation in vgx.dll in Microsoft Internet Explorer 6 through 8 does not properly handle objects in me
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 16, 2011
CVE-2011-1267
38Monitor
The SMB server in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remo
HighCVSS 7.8No exploitEPSS 24%
- Pre-auth
- Denial of service
microsoft · windows 7Jun 16, 2011
CVE-2011-1268
43Plan
The SMB client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, a
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
microsoft · windows 2003 serverJun 16, 2011
CVE-2011-1272
42Plan
Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; an
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
microsoft · excelJun 16, 2011
CVE-2011-1273
42Plan
Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Excel V
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · excelJun 16, 2011
CVE-2011-1274
41Plan
Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; an
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · excelJun 16, 2011
CVE-2011-1275
41Plan
Microsoft Excel 2002 SP3; Office 2004, 2008, and 2011 for Mac; and Open XML File Format Converter for Mac do not properly validate record in
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · excelJun 16, 2011
CVE-2011-1276
45Plan
Buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; E
CriticalCVSS 9.3Proof of conceptEPSS 28%
- pre-auth RCE
- Memory safety
microsoft · excelJun 16, 2011
CVE-2011-1277
42Plan
Microsoft Excel 2002 SP3, Office 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information during
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · excelJun 16, 2011
CVE-2011-1278
42Plan
Microsoft Excel 2002 SP3 and Office 2004 for Mac do not properly validate record information during parsing of Excel spreadsheets, which all
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · excelJun 16, 2011
CVE-2011-1279
42Plan
Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate rec
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · excelJun 16, 2011
CVE-2011-1280
22Monitor
The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio
MediumCVSS 4.3No exploitEPSS 15%
- Pre-auth
- XXE
- Info leak
microsoft · office infopathJun 16, 2011
CVE-2011-1868
44Plan
The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate fields i
CriticalCVSS 10.0No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · windows 2003 serverJun 16, 2011
CVE-2011-1869
34Monitor
The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Wi
HighCVSS 7.8No exploitEPSS 10%
- Pre-auth
- Denial of service
microsoft · windows 2003 serverJun 16, 2011
CVE-2011-1873
43Plan
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 G
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
microsoft · windows 7Jun 16, 2011
CVE-2011-1889
84Now
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execu
CriticalCVSS 9.8KEVWeaponizedEPSS 49%
- pre-auth RCE
- Memory safety
microsoft · forefront threat management gatewayJun 16, 2011
CVE-2011-1894
20Monitor
The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold
MediumCVSS 4.3No exploitEPSS 11%
- Pre-auth
- XSS
microsoft · windows 2003 serverJun 16, 2011
CVE-2011-2095
42Plan
Buffer overflow in Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Windows and Mac OS X allows attackers
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
adobe · acrobat readerJun 16, 2011
CVE-2011-2110
66This week
Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attack
CriticalCVSS 10.0WeaponizedEPSS 86%
- pre-auth RCE
- Memory safety
adobe · flash playerJun 16, 2011
CVE-2011-2202
31Monitor
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST req
MediumCVSS 6.4Proof of conceptEPSS 19%
- Pre-auth
- Path traversal
php · phpJun 16, 2011
CVE-2011-2600
32Monitor
The GPU support functionality in Windows XP does not properly restrict rendering time, which allows remote attackers to cause a denial of se
HighCVSS 7.1No exploitEPSS 11%
- Pre-auth
- Denial of service
microsoft · windows xpJun 30, 2011
CVE-2011-2371
63This week
Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaM
CriticalCVSS 10.0WeaponizedEPSS 75%
- pre-auth RCE
mozilla · seamonkeyJun 30, 2011