Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2012

37 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-3811
    59Plan

    Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before

    CriticalCVSS 10.0WeaponizedEPSS 62%

    avaya · ip office customer call reporterJul 3, 2012

  • CVE-2012-1831
    45Plan

    Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 55

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    wellintech · kingviewJul 4, 2012

  • CVE-2012-2515
    45Plan

    Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HT

    CriticalCVSS 9.3WeaponizedEPSS 27%

    emc · captiva quickscan proJul 4, 2012

  • CVE-2012-2516
    49Plan

    An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Hist

    CriticalCVSS 9.3WeaponizedEPSS 39%

    ge · intelligent platforms proficy batch executionJul 4, 2012

  • CVE-2012-2386
    43Plan

    Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote

    HighCVSS 7.5Proof of conceptEPSS 42%

    php · phpJul 7, 2012

  • CVE-2012-1493
    50Plan

    F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manage

    HighCVSS 7.8WeaponizedEPSS 63%

    f5 · big-ip application security managerJul 9, 2012

  • CVE-2012-2138
    24Monitor

    The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attem

    MediumCVSS 5.0Proof of conceptEPSS 14%

    apache · org.apache.sling.servlets.postJul 9, 2012

  • CVE-2012-0175
    43Plan

    The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Wind

    HighCVSS 8.8No exploitEPSS 26%

    microsoft · windows 2003 serverJul 10, 2012

  • CVE-2012-1522
    43Plan

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerJul 10, 2012

  • CVE-2012-1524
    43Plan

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · internet explorerJul 10, 2012

  • CVE-2012-1854
    67This week

    Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basi

    HighCVSS 7.8KEVWeaponizedEPSS 20%

    microsoft · officeJul 10, 2012

  • CVE-2012-1859
    24Monitor

    Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gol

    MediumCVSS 4.3No exploitEPSS 23%

    microsoft · office web appsJul 10, 2012

  • CVE-2012-1860
    26Monitor

    Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not prope

    MediumCVSS 5.5No exploitEPSS 12%

    microsoft · office web appsJul 10, 2012

  • CVE-2012-1861
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Offi

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · office web appsJul 10, 2012

  • CVE-2012-1862
    30Monitor

    Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary we

    MediumCVSS 6.8No exploitEPSS 10%

    microsoft · sharepoint serverJul 10, 2012

  • CVE-2012-1863
    24Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and Sha

    MediumCVSS 4.3No exploitEPSS 23%

    microsoft · office sharepoint serverJul 10, 2012

  • CVE-2012-1891
    48Plan

    Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows r

    CriticalCVSS 9.8No exploitEPSS 29%

    microsoft · data access componentsJul 10, 2012

  • CVE-2012-2019
    59Plan

    Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka

    CriticalCVSS 10.0WeaponizedEPSS 63%

    hp · operations agentJul 11, 2012

  • CVE-2012-2020
    59Plan

    Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka

    CriticalCVSS 10.0WeaponizedEPSS 64%

    hp · operations agentJul 11, 2012

  • CVE-2012-0911
    58Plan

    TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object i

    CriticalCVSS 9.8WeaponizedEPSS 62%

    tiki · tikiwiki cms\/groupwareJul 12, 2012

  • CVE-2012-2763
    55Plan

    Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allo

    HighCVSS 7.5WeaponizedEPSS 81%

    gimp · gimpJul 12, 2012

  • CVE-2012-3399
    50Plan

    Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.

    HighCVSS 7.5WeaponizedEPSS 65%

    artis.imag · basilicJul 12, 2012

  • CVE-2012-1661
    44Plan

    ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assi

    CriticalCVSS 9.3Proof of conceptEPSS 23%

    esri · arcmapJul 12, 2012

  • CVE-2012-3236
    20Monitor

    fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a m

    MediumCVSS 4.3Proof of conceptEPSS 10%

    gimp · gimpJul 12, 2012

  • CVE-2012-4031
    36Monitor

    Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary

    MediumCVSS 5.0WeaponizedEPSS 52%

    wangkongbao · cns-1000Jul 17, 2012

  • CVE-2012-4032
    26Monitor

    Open redirect vulnerability in the login page in WebsitePanel before 1.2.2.1 allows remote attackers to redirect users to arbitrary web site

    MediumCVSS 5.8Proof of conceptEPSS 10%

    websitepanel · websitepanelJul 17, 2012

  • CVE-2012-0284
    48Plan

    Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC2

    CriticalCVSS 9.3WeaponizedEPSS 36%

    cisco · linksys playerpt activex controlJul 19, 2012

  • CVE-2012-2688
    43Plan

    Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has u

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    php · phpJul 20, 2012

  • CVE-2012-2738
    19Monitor

    The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU cons

    MediumCVSS 4.0Proof of conceptEPSS 11%

    nalin dahyabhai · vteJul 22, 2012

  • CVE-2012-2953
    60This week

    The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input

    CriticalCVSS 10.0WeaponizedEPSS 67%

    symantec · web gatewayJul 23, 2012

  • CVE-2012-2957
    46Plan

    The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain privileges by modifying files, related to a

    HighCVSS 7.2Proof of conceptEPSS 59%

    symantec · web gatewayJul 23, 2012

  • CVE-2012-3571
    28Monitor

    ISC DHCP 4.1.2 through 4.2.4 and 4.1-ESV before 4.1-ESV-R6 allows remote attackers to cause a denial of service (infinite loop and CPU consu

    MediumCVSS 6.1Proof of conceptEPSS 12%

    isc · dhcpJul 25, 2012

  • CVE-2012-3817
    38Monitor

    ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, whe

    HighCVSS 7.8No exploitEPSS 23%

    isc · bindJul 25, 2012

  • CVE-2011-2657
    42Plan

    Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminS

    MediumCVSS 6.8WeaponizedEPSS 48%

    novell · zenworks configuration managementJul 26, 2012

  • CVE-2012-2962
    46Plan

    SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authen

    MediumCVSS 6.5WeaponizedEPSS 66%

    sonicwall · scrutinizerJul 30, 2012

  • CVE-2012-2626
    33Monitor

    cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authenticati

    MediumCVSS 5.0WeaponizedEPSS 44%

    sonicwall · scrutinizerJul 31, 2012

  • CVE-2012-3951
    46Plan

    The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (

    HighCVSS 7.5WeaponizedEPSS 51%

    sonicwall · scrutinizerJul 31, 2012