Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2012

52 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-1667
    38Monitor

    ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly h

    HighCVSS 8.5No exploitEPSS 13%

    isc · bindJun 5, 2012

  • CVE-2012-1185
    39Monitor

    Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause

    HighCVSS 7.8No exploitEPSS 27%

    imagemagick · imagemagickJun 5, 2012

  • CVE-2011-1761
    30Monitor

    Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_abc.cpp in libmodplug before 0.8

    MediumCVSS 6.8Proof of conceptEPSS 10%

    konstanty bialkowski · libmodplugJun 7, 2012

  • CVE-2012-0985
    41Plan

    Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wizard 1.0; VAIO Wirel

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    sony · smartwi connection utillityJun 7, 2012

  • CVE-2012-0507
    98Now

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    oracle · jreJun 7, 2012

  • CVE-2012-2034
    62This week

    Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236

    HighCVSS 7.5KEVWeaponizedEPSS 7%

    adobe · flash playerJun 8, 2012

  • CVE-2012-0677
    42Plan

    Heap-based buffer overflow in Apple iTunes before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (app

    CriticalCVSS 9.3Proof of conceptEPSS 15%

    apple · itunesJun 12, 2012

  • CVE-2012-0173
    43Plan

    The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Se

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · windows 7Jun 12, 2012

  • CVE-2012-0217
    40Plan

    The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Orac

    HighCVSS 7.2WeaponizedEPSS 39%

    xen · xenJun 12, 2012

  • CVE-2012-1523
    44Plan

    Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1849
    43Plan

    Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Tr

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · lyncJun 12, 2012

  • CVE-2012-1855
    43Plan

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execut

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · .net frameworkJun 12, 2012

  • CVE-2012-1857
    20Monitor

    Cross-site scripting (XSS) vulnerability in the Enterprise Portal component in Microsoft Dynamics AX 2012 allows remote attackers to inject

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · dynamics axJun 12, 2012

  • CVE-2012-1858
    24Monitor

    The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Atten

    MediumCVSS 4.3Proof of conceptEPSS 22%

    microsoft · lyncJun 12, 2012

  • CVE-2012-1873
    22Monitor

    Microsoft Internet Explorer 7 through 9 does not properly create and initialize string data, which allows remote attackers to obtain sensiti

    MediumCVSS 4.3No exploitEPSS 18%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1874
    44Plan

    Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows user-assisted remote attackers to execute arbit

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1875
    55Plan

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3WeaponizedEPSS 61%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1876
    56Plan

    Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers

    CriticalCVSS 9.3WeaponizedEPSS 64%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1877
    44Plan

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1878
    44Plan

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1879
    38Monitor

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    HighCVSS 8.1No exploitEPSS 19%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1880
    44Plan

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1881
    44Plan

    Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by a

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1882
    21Monitor

    Microsoft Internet Explorer 6 through 9 does not block cross-domain scrolling events, which allows remote attackers to read content from a d

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · internet explorerJun 12, 2012

  • CVE-2012-1889
    90Now

    Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitra

    HighCVSS 8.8KEVWeaponizedEPSS 83%

    microsoft · xml core servicesJun 13, 2012

  • CVE-2012-1502
    34Monitor

    Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (

    HighCVSS 7.5Proof of conceptEPSS 14%

    pypam · pypamJun 15, 2012

  • CVE-2012-3574
    33Monitor

    Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allow

    HighCVSS 7.5Proof of conceptEPSS 11%

    wordpress · wordpressJun 15, 2012

  • CVE-2012-3575
    45Plan

    Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitr

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    rbx gallery · rbx galleryJun 15, 2012

  • CVE-2012-3576
    46Plan

    Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to ex

    CriticalCVSS 10.0Proof of conceptEPSS 18%

    wordpress · wordpressJun 15, 2012

  • CVE-2011-1473
    40Plan

    OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, w

    MediumCVSS 5.0Proof of conceptEPSS 67%

    openssl · opensslJun 16, 2012

  • CVE-2012-1723
    97Now

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier,

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    oracle · jdkJun 16, 2012

  • CVE-2012-0037
    30Monitor

    Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and ot

    MediumCVSS 6.5No exploitEPSS 13%

    libreoffice · libreofficeJun 16, 2012

  • CVE-2012-3577
    34Monitor

    Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attac

    HighCVSS 7.5Proof of conceptEPSS 13%

    nmedia · member conversationJun 16, 2012

  • CVE-2009-0693
    34Monitor

    Multiple buffer overflows in Wyse Device Manager (WDM) 4.7.x allow remote attackers to execute arbitrary code via (1) the User-Agent HTTP he

    HighCVSS 7.5Proof of conceptEPSS 12%

    dell · wyse device managerJun 19, 2012

  • CVE-2009-0695
    51Plan

    hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain manageme

    HighCVSS 7.5WeaponizedEPSS 68%

    dell · wyse device managerJun 19, 2012

  • CVE-2012-2334
    31Monitor

    Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before

    MediumCVSS 6.8No exploitEPSS 13%

    libreoffice · libreofficeJun 19, 2012

  • CVE-2012-3588
    23Monitor

    Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary

    MediumCVSS 5.0Proof of conceptEPSS 10%

    wordpress · plugin newsletter pluginJun 19, 2012

  • CVE-2012-2174
    48Plan

    The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.

    CriticalCVSS 9.3WeaponizedEPSS 38%

    ibm · lotus notesJun 20, 2012

  • CVE-2012-2175
    46Plan

    Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows

    CriticalCVSS 9.3WeaponizedEPSS 29%

    ibm · lotus inotesJun 20, 2012

  • CVE-2012-1149
    34Monitor

    Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows r

    HighCVSS 7.5No exploitEPSS 14%

    libreoffice · libreofficeJun 21, 2012

  • CVE-2012-2149
    34Monitor

    The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allow

    HighCVSS 7.5No exploitEPSS 13%

    libwpd · libwpdJun 21, 2012

  • CVE-2012-3792
    23Monitor

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to ca

    MediumCVSS 5.0Proof of conceptEPSS 10%

    pro-face · pro-server exJun 25, 2012

  • CVE-2012-3793
    24Monitor

    Integer overflow in Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows re

    MediumCVSS 5.0Proof of conceptEPSS 11%

    pro-face · pro-server exJun 25, 2012

  • CVE-2012-3794
    26Monitor

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to ca

    MediumCVSS 5.0Proof of conceptEPSS 21%

    pro-face · pro-server exJun 25, 2012

  • CVE-2012-3795
    23Monitor

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to ca

    MediumCVSS 5.0Proof of conceptEPSS 10%

    pro-face · pro-server exJun 25, 2012

  • CVE-2012-3796
    23Monitor

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to ob

    MediumCVSS 5.0Proof of conceptEPSS 10%

    pro-face · pro-server exJun 25, 2012

  • CVE-2012-3797
    44Plan

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, does not properly check packe

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    pro-face · pro-server exJun 25, 2012

  • CVE-2012-2122
    49Plan

    sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x befo

    MediumCVSS 5.1WeaponizedEPSS 96%

    oracle · mysqlJun 26, 2012

  • CVE-2012-3814
    33Monitor

    Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 10%

    wordpress · wordpressJun 27, 2012

  • CVE-2012-3815
    50Plan

    Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attacker

    CriticalCVSS 9.3WeaponizedEPSS 44%

    sielcosistemi · winlog liteJun 27, 2012

  • CVE-2012-2098
    24Monitor

    Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons C

    MediumCVSS 5.0No exploitEPSS 12%

    apache · commons compressJun 29, 2012

  • CVE-2012-2385
    19Monitor

    The terminal dispatcher in mosh before 1.2.1 allows remote authenticated users to cause a denial of service (long loop and CPU consumption)

    MediumCVSS 4.0Proof of conceptEPSS 10%

    keith winstein · moshJun 29, 2012