Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2012

36 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2011-3659
    48Plan

    Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMon

    CriticalCVSS 9.3WeaponizedEPSS 36%

    mozilla · firefoxFeb 1, 2012

  • CVE-2010-4562
    21Monitor

    Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when using IPv6, allows remote attackers to determine whether a host is sniffing the n

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · windows 2000Feb 2, 2012

  • CVE-2011-4875
    41Plan

    Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    siemens · wincc flexibleFeb 3, 2012

  • CVE-2011-4878
    34Monitor

    Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinC

    HighCVSS 7.8Proof of conceptEPSS 11%

    siemens · wincc flexibleFeb 3, 2012

  • CVE-2011-4879
    38Monitor

    miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Upd

    HighCVSS 8.5Proof of conceptEPSS 12%

    siemens · wincc flexibleFeb 3, 2012

  • CVE-2011-4041
    45Plan

    webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long st

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    broadwin · webaccessFeb 6, 2012

  • CVE-2012-0830
    39Monitor

    The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request contai

    HighCVSS 7.5Proof of conceptEPSS 29%

    php · phpFeb 6, 2012

  • CVE-2012-1006
    34Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script

    MediumCVSS 4.3Proof of conceptEPSS 56%

    apache · strutsFeb 7, 2012

  • CVE-2012-1007
    27Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML vi

    MediumCVSS 4.3Proof of conceptEPSS 32%

    apache · strutsFeb 7, 2012

  • CVE-2012-1008
    23Monitor

    OfficeSIP Server 3.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted To header in a SIP INVITE message.

    MediumCVSS 5.0Proof of conceptEPSS 11%

    officesip · officesip serverFeb 8, 2012

  • CVE-2012-1033
    24Monitor

    The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response

    MediumCVSS 5.0No exploitEPSS 13%

    isc · bindFeb 8, 2012

  • CVE-2012-0840
    33Monitor

    tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger

    MediumCVSS 5.0Proof of conceptEPSS 42%

    apache · portable runtimeFeb 10, 2012

  • CVE-2012-0010
    21Monitor

    Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations, which allows user-assisted remote attackers to

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · internet explorerFeb 14, 2012

  • CVE-2012-0011
    45Plan

    Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · internet explorerFeb 14, 2012

  • CVE-2012-0012
    22Monitor

    Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to r

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · internet explorerFeb 14, 2012

  • CVE-2012-0014
    39Monitor

    Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated w

    HighCVSS 7.8No exploitEPSS 27%

    microsoft · .net frameworkFeb 14, 2012

  • CVE-2012-0015
    44Plan

    Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · .net frameworkFeb 14, 2012

  • CVE-2012-0017
    22Monitor

    Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to in

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · sharepoint foundationFeb 14, 2012

  • CVE-2012-0019
    43Plan

    Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · visio viewerFeb 14, 2012

  • CVE-2012-0020
    43Plan

    Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · visio viewerFeb 14, 2012

  • CVE-2012-0136
    43Plan

    Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · visio viewerFeb 14, 2012

  • CVE-2012-0137
    43Plan

    Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · visio viewerFeb 14, 2012

  • CVE-2012-0138
    43Plan

    Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · visio viewerFeb 14, 2012

  • CVE-2012-0144
    22Monitor

    Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · sharepoint serverFeb 14, 2012

  • CVE-2012-0145
    22Monitor

    Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundatio

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · sharepoint serverFeb 14, 2012

  • CVE-2012-0150
    44Plan

    Buffer overflow in msvcrt.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows rem

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · windows 7Feb 14, 2012

  • CVE-2012-0155
    57Plan

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3No exploitEPSS 65%

    microsoft · internet explorerFeb 14, 2012

  • CVE-2012-0500
    57Plan

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,

    CriticalCVSS 10.0WeaponizedEPSS 58%

    oracle · jreFeb 15, 2012

  • CVE-2012-0754
    89Now

    Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x

    HighCVSS 8.1KEVWeaponizedEPSS 91%

    adobe · flash playerFeb 16, 2012

  • CVE-2012-0756
    41Plan

    Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x

    CriticalCVSS 9.3No exploitEPSS 14%

    adobe · flash playerFeb 16, 2012

  • CVE-2012-0767
    60This week

    Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, a

    MediumCVSS 6.1KEVWeaponizedEPSS 6%

    adobe · flash playerFeb 16, 2012

  • CVE-2011-3026
    49Plan

    Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly ha

    MediumCVSS 6.8Proof of conceptEPSS 72%

    google · chromeFeb 16, 2012

  • CVE-2012-1195
    51Plan

    Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Leno

    HighCVSS 7.5WeaponizedEPSS 68%

    landesk · lenovo thinkmanagement consoleFeb 17, 2012

  • CVE-2012-1196
    40Plan

    Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allo

    MediumCVSS 5.0WeaponizedEPSS 51%

    landesk · lenovo thinkmanagement consoleFeb 17, 2012

  • CVE-2012-1226
    37Monitor

    Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute

    HighCVSS 7.5Proof of conceptEPSS 23%

    dolibarr · dolibarr erp\/crmFeb 21, 2012

  • CVE-2012-1205
    37Monitor

    PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers t

    HighCVSS 7.5Proof of conceptEPSS 24%

    wordpress · wordpressFeb 24, 2012