Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2012

41 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-0549
    48Plan

    Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to aff

    HighCVSS 7.5WeaponizedEPSS 59%

    oracle · supply chain products suiteMay 3, 2012

  • CVE-2012-0551
    26Monitor

    Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and th

    MediumCVSS 5.8Proof of conceptEPSS 11%

    oracle · glassfish serverMay 3, 2012

  • CVE-2012-1710
    71This week

    Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers t

    CriticalCVSS 9.8KEVWeaponizedEPSS 7%

    oracle · fusion middlewareMay 3, 2012

  • CVE-2012-0202
    56Plan

    Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote at

    CriticalCVSS 10.0WeaponizedEPSS 54%

    ibm · cognos tm1May 4, 2012

  • CVE-2012-0779
    63This week

    Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x

    CriticalCVSS 9.3WeaponizedEPSS 87%

    adobe · flash playerMay 4, 2012

  • CVE-2012-1675
    53Plan

    The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Orac

    HighCVSS 7.5WeaponizedEPSS 77%

    oracle · database serverMay 8, 2012

  • CVE-2012-0018
    45Plan

    Microsoft Visio Viewer 2010 Gold and SP1 does not properly validate attributes in Visio files, which allows remote attackers to execute arbi

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · visio viewerMay 8, 2012

  • CVE-2012-0141
    44Plan

    Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelMay 8, 2012

  • CVE-2012-0142
    43Plan

    Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelMay 8, 2012

  • CVE-2012-0143
    44Plan

    Microsoft Excel 2003 SP3 and Office 2008 for Mac do not properly handle memory during the opening of files, which allows remote attackers to

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · excelMay 8, 2012

  • CVE-2012-0159
    45Plan

    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · officeMay 8, 2012

  • CVE-2012-0160
    44Plan

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5 SP1, 3.5.1, and 4 does not properly serialize input data, which allows remo

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · .net frameworkMay 8, 2012

  • CVE-2012-0161
    44Plan

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5 SP1, 3.5.1, and 4 does not properly handle an unspecified exception during

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · .net frameworkMay 8, 2012

  • CVE-2012-0162
    44Plan

    Microsoft .NET Framework 4 does not properly allocate buffers, which allows remote attackers to execute arbitrary code via (1) a crafted XAM

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · .net frameworkMay 8, 2012

  • CVE-2012-0164
    25Monitor

    Microsoft .NET Framework 4 does not properly compare index values, which allows remote attackers to cause a denial of service (application h

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · .net frameworkMay 8, 2012

  • CVE-2012-0165
    45Plan

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2 and Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1 does not properly valid

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · officeMay 8, 2012

  • CVE-2012-0167
    46Plan

    Heap-based buffer overflow in the Office GDI+ library in Microsoft Office 2003 SP3 and 2007 SP2 and SP3 allows remote attackers to execute a

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · officeMay 8, 2012

  • CVE-2012-0176
    44Plan

    Double free vulnerability in Microsoft Silverlight 4 before 4.1.10329 on Windows allows remote attackers to execute arbitrary code via vecto

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · silverlightMay 8, 2012

  • CVE-2012-0183
    44Plan

    Microsoft Word 2003 SP3 and 2007 SP2 and SP3, Office 2008 and 2011 for Mac, and Office Compatibility Pack SP2 and SP3 allow remote attackers

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · officeMay 8, 2012

  • CVE-2012-0184
    44Plan

    Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 and 2011 for Mac; Excel Viewer; and Office Compatibility Pack

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · excelMay 8, 2012

  • CVE-2012-0185
    44Plan

    Heap-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 Gold and SP1, Excel Viewer, and Office Compatibility Pack SP2 and SP

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · excelMay 8, 2012

  • CVE-2012-1847
    45Plan

    Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 and 2011 for Mac; Excel Viewer; and Office Compatibility Pack

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · excelMay 8, 2012

  • CVE-2012-0778
    43Plan

    Buffer overflow in Adobe Flash Professional before CS6 allows attackers to execute arbitrary code via unspecified vectors.

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash cs3May 9, 2012

  • CVE-2012-0780
    45Plan

    Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vec

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    adobe · illustratorMay 9, 2012

  • CVE-2012-2027
    41Plan

    Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arb

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    adobe · photoshopMay 9, 2012

  • CVE-2012-2031
    45Plan

    Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns

    CriticalCVSS 10.0No exploitEPSS 18%

    adobe · shockwave playerMay 9, 2012

  • CVE-2012-1823
    99Now

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle que

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    php · phpMay 11, 2012

  • CVE-2012-2311
    51Plan

    sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle que

    HighCVSS 7.5Proof of conceptEPSS 69%

    php · phpMay 11, 2012

  • CVE-2012-2329
    40Plan

    Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a d

    MediumCVSS 5.0WeaponizedEPSS 61%

    php · phpMay 11, 2012

  • CVE-2012-2335
    40Plan

    php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.

    HighCVSS 7.5No exploitEPSS 32%

    php · phpMay 11, 2012

  • CVE-2012-2336
    35Monitor

    sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle que

    MediumCVSS 5.0Proof of conceptEPSS 50%

    php · phpMay 11, 2012

  • CVE-2012-2333
    35Monitor

    Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC en

    MediumCVSS 6.8No exploitEPSS 27%

    openssl · opensslMay 14, 2012

  • CVE-2012-2611
    50Plan

    The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeav

    CriticalCVSS 9.3WeaponizedEPSS 44%

    sap · netweaverMay 15, 2012

  • CVE-2012-0663
    46Plan

    Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a

    CriticalCVSS 9.3WeaponizedEPSS 28%

    apple · quicktimeMay 16, 2012

  • CVE-2012-0207
    36Monitor

    The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divi

    HighCVSS 7.5Proof of conceptEPSS 20%

    linux · linux kernelMay 17, 2012

  • CVE-2012-2376
    46Plan

    Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    php · phpMay 21, 2012

  • CVE-2012-2915
    46Plan

    Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long stri

    CriticalCVSS 9.3WeaponizedEPSS 29%

    lattice semiconductor · pac-designerMay 21, 2012

  • CVE-2012-0297
    62This week

    The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote

    CriticalCVSS 10.0WeaponizedEPSS 72%

    symantec · web gatewayMay 21, 2012

  • CVE-2012-0299
    59Plan

    The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code

    CriticalCVSS 10.0WeaponizedEPSS 63%

    symantec · web gatewayMay 21, 2012

  • CVE-2012-2926
    60This week

    Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 befor

    CriticalCVSS 9.1WeaponizedEPSS 66%

    atlassian · bambooMay 22, 2012

  • CVE-2012-2176
    46Plan

    Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow

    CriticalCVSS 9.3WeaponizedEPSS 31%

    ibm · lotus quickrMay 25, 2012