Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2011

35 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2011-1944
    41Plan

    Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    xmlsoft · libxml2Sep 2, 2011

  • CVE-2011-2763
    41Plan

    The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a mo

    HighCVSS 7.5WeaponizedEPSS 36%

    lifesize · lifesize room applianceSep 2, 2011

  • CVE-2011-3205
    35Monitor

    Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, an

    MediumCVSS 6.8No exploitEPSS 27%

    squid-cache · squidSep 6, 2011

  • CVE-2011-3200
    40Plan

    Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 thro

    MediumCVSS 5.0WeaponizedEPSS 20%

    rsyslog · rsyslogSep 6, 2011

  • CVE-2011-3389
    40Plan

    The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Op

    MediumCVSS 4.3WeaponizedEPSS 73%

    google · chromeSep 6, 2011

  • CVE-2009-5092
    21Monitor

    Cross-site scripting (XSS) vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inje

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · fast espSep 12, 2011

  • CVE-2011-2595
    58Plan

    Multiple stack-based buffer overflows in ACDSee FotoSlate 4.0 Build 146 allow remote attackers to execute arbitrary code via a long id param

    CriticalCVSS 10.0WeaponizedEPSS 59%

    acdsee · fotoslateSep 14, 2011

  • CVE-2011-0653
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010 Gold and SP1, and SharePoint Foundation 2010, allows rem

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · sharepoint foundationSep 15, 2011

  • CVE-2011-1890
    23Monitor

    Cross-site scripting (XSS) vulnerability in EditForm.aspx in Microsoft Office SharePoint Server 2010 and SharePoint Foundation 2010 allows r

    MediumCVSS 4.3No exploitEPSS 19%

    microsoft · sharepoint foundationSep 15, 2011

  • CVE-2011-1891
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allo

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · sharepoint foundationSep 15, 2011

  • CVE-2011-1892
    28Monitor

    Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, O

    MediumCVSS 4.0Proof of conceptEPSS 41%

    microsoft · forms serverSep 15, 2011

  • CVE-2011-1893
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010, Windows SharePoint Services 2.0 and 3.0 SP2, and ShareP

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · sharepoint foundationSep 15, 2011

  • CVE-2011-1980
    40Plan

    Untrusted search path vulnerability in Microsoft Office 2003 SP3 and 2007 SP2 allows local users to gain privileges via a Trojan horse DLL i

    CriticalCVSS 9.3No exploitEPSS 10%

    microsoft · officeSep 15, 2011

  • CVE-2011-1982
    45Plan

    Microsoft Office 2007 SP2, and 2010 Gold and SP1, does not initialize an unspecified object pointer during the opening of Word documents, wh

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · officeSep 15, 2011

  • CVE-2011-1986
    43Plan

    Use-after-free vulnerability in Microsoft Excel 2003 SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "E

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelSep 15, 2011

  • CVE-2011-1987
    43Plan

    Array index error in Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · excelSep 15, 2011

  • CVE-2011-1988
    43Plan

    Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · excelSep 15, 2011

  • CVE-2011-1989
    45Plan

    Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and SP1; Office 2004, 20

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · excelSep 15, 2011

  • CVE-2011-1990
    43Plan

    Microsoft Excel 2007 SP2; Excel in Office 2007 SP2; Excel Viewer SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Fo

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · excelSep 15, 2011

  • CVE-2011-1991
    41Plan

    Multiple untrusted search path vulnerabilities in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Serv

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · windows 2003 serverSep 15, 2011

  • CVE-2011-3322
    59Plan

    Core Server HMI Service (Coreservice.exe) in Scadatec Limited Procyon SCADA 1.06, and other versions before 1.14, allows remote attackers to

    CriticalCVSS 10.0WeaponizedEPSS 64%

    scadatec · procyon scadaSep 15, 2011

  • CVE-2011-3486
    40Plan

    Beckhoff TwinCAT 2.11.0.2004 and earlier allows remote attackers to cause a denial of service via a crafted request to UDP port 48899, which

    MediumCVSS 5.0WeaponizedEPSS 49%

    beckhoff · twincatSep 16, 2011

  • CVE-2011-3490
    51Plan

    Multiple stack-based buffer overflows in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to cause a denial of s

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    measuresoft · scadaproSep 16, 2011

  • CVE-2011-3491
    45Plan

    Heap-based buffer overflow in Progea Movicon / PowerHMI 11.2.1085 and earlier allows remote attackers to cause a denial of service (crash) a

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    progea · movicon powerhmiSep 16, 2011

  • CVE-2011-3492
    61This week

    Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows remote attackers to cause a denial of service (crash)

    CriticalCVSS 10.0WeaponizedEPSS 70%

    azeotech · daqfactorySep 16, 2011

  • CVE-2011-3494
    57Plan

    WinSig.exe in eSignal 10.6.2425 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code

    CriticalCVSS 10.0WeaponizedEPSS 55%

    interactivedata · esignalSep 16, 2011

  • CVE-2011-3495
    43Plan

    Multiple directory traversal vulnerabilities in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to read, modify

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    measuresoft · scadaproSep 16, 2011

  • CVE-2011-3496
    44Plan

    service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    measuresoft · scadaproSep 16, 2011

  • CVE-2011-3497
    57Plan

    service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possib

    CriticalCVSS 10.0WeaponizedEPSS 57%

    measuresoft · scadaproSep 16, 2011

  • CVE-2011-3499
    45Plan

    Progea Movicon / PowerHMI 11.2.1085 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) and possi

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    progea · movicon powerhmiSep 16, 2011

  • CVE-2011-2738
    43Plan

    Multiple unspecified vulnerabilities in Cisco Unified Service Monitor before 8.6, as used in Unified Operations Manager before 8.6 and Cisco

    CriticalCVSS 10.0No exploitEPSS 10%

    cisco · unified service monitorSep 19, 2011

  • CVE-2011-3575
    39Monitor

    Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users

    CriticalCVSS 9.0Proof of conceptEPSS 10%

    ibm · lotus dominoSep 19, 2011

  • CVE-2011-3348
    24Monitor

    The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote

    MediumCVSS 4.3No exploitEPSS 22%

    apache · http serverSep 20, 2011

  • CVE-2011-3360
    47Plan

    Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Troja

    CriticalCVSS 9.3WeaponizedEPSS 34%

    wireshark · wiresharkSep 20, 2011

  • CVE-2011-2543
    39Monitor

    Buffer overflow in the cuil component in Cisco Telepresence System Integrator C Series 4.x before TC4.2.0 allows remote authenticated users

    CriticalCVSS 9.0Proof of conceptEPSS 11%

    cisco · telepresence codec c40Sep 23, 2011