Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2012

43 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-3450
    13Monitor

    pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string d

    LowCVSS 2.6Proof of conceptEPSS 11%

    php · phpAug 6, 2012

  • CVE-2012-4177
    57Plan

    The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path comma

    CriticalCVSS 10.0WeaponizedEPSS 58%

    ubi · uplay pcAug 7, 2012

  • CVE-2012-2577
    20Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attacke

    MediumCVSS 4.3Proof of conceptEPSS 10%

    solarwinds · orion network performance monitorAug 12, 2012

  • CVE-2012-2371
    21Monitor

    Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitra

    MediumCVSS 4.3Proof of conceptEPSS 12%

    wordpress · wordpressAug 13, 2012

  • CVE-2012-4329
    35Monitor

    The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart) via a crafted cont

    HighCVSS 7.8Proof of conceptEPSS 13%

    samsung · d6000 firmwareAug 14, 2012

  • CVE-2012-4330
    35Monitor

    The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long string in certain f

    HighCVSS 7.8Proof of conceptEPSS 13%

    samsung · d6000 firmwareAug 14, 2012

  • CVE-2012-4333
    58Plan

    Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in

    CriticalCVSS 10.0WeaponizedEPSS 59%

    samsung · net-i viewerAug 14, 2012

  • CVE-2012-1526
    43Plan

    Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by a

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerAug 14, 2012

  • CVE-2012-1850
    28Monitor

    The Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3, Windows Server

    MediumCVSS 5.0No exploitEPSS 27%

    microsoft · windows 7Aug 14, 2012

  • CVE-2012-1851
    60This week

    Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Wi

    CriticalCVSS 10.0No exploitEPSS 65%

    microsoft · windows 7Aug 14, 2012

  • CVE-2012-1852
    49Plan

    Heap-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows

    CriticalCVSS 10.0No exploitEPSS 29%

    microsoft · windows xpAug 14, 2012

  • CVE-2012-1853
    49Plan

    Stack-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows

    CriticalCVSS 10.0No exploitEPSS 29%

    microsoft · windows xpAug 14, 2012

  • CVE-2012-1856
    87Now

    The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 200

    HighCVSS 8.8KEVWeaponizedEPSS 72%

    microsoft · commerce serverAug 14, 2012

  • CVE-2012-1888
    44Plan

    Buffer overflow in Microsoft Visio 2010 SP1 and Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · visioAug 14, 2012

  • CVE-2012-2521
    43Plan

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerAug 14, 2012

  • CVE-2012-2522
    44Plan

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerAug 14, 2012

  • CVE-2012-2523
    44Plan

    Integer overflow in Microsoft Internet Explorer 8 and 9, JScript 5.8, and VBScript 5.8 on 64-bit platforms allows remote attackers to execut

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerAug 14, 2012

  • CVE-2012-2526
    45Plan

    The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP3 does not properly process packets in memory, which allows remot

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · windows xpAug 14, 2012

  • CVE-2012-2524
    43Plan

    Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · officeAug 15, 2012

  • CVE-2012-1525
    50Plan

    Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allows attackers to e

    CriticalCVSS 10.0No exploitEPSS 31%

    adobe · acrobatAug 15, 2012

  • CVE-2012-1535
    82Now

    Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote a

    HighCVSS 7.8KEVWeaponizedEPSS 70%

    adobe · flash playerAug 15, 2012

  • CVE-2012-2049
    44Plan

    Stack-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allows attackers to

    CriticalCVSS 10.0No exploitEPSS 13%

    adobe · acrobatAug 15, 2012

  • CVE-2012-2050
    44Plan

    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allows attackers to execute arbi

    CriticalCVSS 10.0No exploitEPSS 13%

    adobe · acrobatAug 15, 2012

  • CVE-2012-4149
    44Plan

    Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allow attackers to execute arbitrary code or cause

    CriticalCVSS 10.0No exploitEPSS 13%

    adobe · acrobatAug 15, 2012

  • CVE-2012-4157
    54Plan

    Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allow attackers to execute arbitrary code or cause

    CriticalCVSS 10.0No exploitEPSS 45%

    adobe · acrobatAug 15, 2012

  • CVE-2012-4353
    44Plan

    Stack-based buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows rem

    CriticalCVSS 9.3Proof of conceptEPSS 24%

    sielcosistemi · winlog proAug 19, 2012

  • CVE-2012-4356
    25Monitor

    Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow re

    MediumCVSS 4.3WeaponizedEPSS 27%

    sielcosistemi · winlog proAug 19, 2012

  • CVE-2012-3456
    36Monitor

    Heap-based buffer overflow in the read function in filters/words/msword-odf/wv2/src/styles.cpp in the Microsoft import filter in Calligra 2.

    HighCVSS 7.5Proof of conceptEPSS 20%

    calligra · calligraAug 20, 2012

  • CVE-2012-4361
    44Plan

    lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary comma

    HighCVSS 7.7WeaponizedEPSS 47%

    hp · san\/iqAug 20, 2012

  • CVE-2012-4598
    46Plan

    An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3WeaponizedEPSS 29%

    mcafee · mcafee virtual technicianAug 22, 2012

  • CVE-2012-2687
    17Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in

    LowCVSS 2.6No exploitEPSS 22%

    apache · http serverAug 22, 2012

  • CVE-2011-5106
    20Monitor

    Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote a

    MediumCVSS 4.3Proof of conceptEPSS 10%

    wordpress · wordpressAug 23, 2012

  • CVE-2011-5124
    56Plan

    Stack-based buffer overflow in the BCAAA component before build 60258, as used by Blue Coat ProxySG 4.2.3 through 6.1 and ProxyOne, allows r

    CriticalCVSS 10.0WeaponizedEPSS 54%

    bluecoat · proxyoneAug 26, 2012

  • CVE-2011-5127
    44Plan

    Directory traversal vulnerability in Blue Coat Reporter 9.x before 9.2.4.13, 9.2.5.x before 9.2.5.1, and 9.3 before 9.3.1.2 on Windows allow

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    bluecoat · reporterAug 26, 2012

  • CVE-2012-3485
    29Monitor

    Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable fil

    HighCVSS 7.2WeaponizedEPSS 3%

    google · tunnelblickAug 26, 2012

  • CVE-2012-4681
    99Now

    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    oracle · jdkAug 27, 2012

  • CVE-2011-4926
    20Monitor

    Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remot

    MediumCVSS 4.3Proof of conceptEPSS 10%

    wordpress · wordpressAug 29, 2012

  • CVE-2012-3579
    43Plan

    Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers t

    HighCVSS 7.9WeaponizedEPSS 40%

    symantec · messaging gatewayAug 29, 2012

  • CVE-2011-1398
    20Monitor

    The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage ret

    MediumCVSS 4.3Proof of conceptEPSS 10%

    php · phpAug 30, 2012

  • CVE-2011-5130
    38Monitor

    dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary

    MediumCVSS 6.8WeaponizedEPSS 36%

    haudenschilt · family connections cmsAug 30, 2012

  • CVE-2012-0547
    4Monitor

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earl

    CVSS 0.0Proof of conceptEPSS 12%

    oracle · jdkAug 30, 2012

  • CVE-2012-4170
    40Plan

    Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file.

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    adobe · photoshop cs6Aug 31, 2012

  • CVE-2010-5193
    47Plan

    Stack-based buffer overflow in the TIFMergeMultiFiles function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom I

    CriticalCVSS 9.3WeaponizedEPSS 31%

    viscomsoft · image viewer cp gold sdkAug 31, 2012