Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2012

35 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-2288
    47Plan

    Format string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4.1, and 8.0 before 8.0.0.1, allows remote a

    CriticalCVSS 9.3WeaponizedEPSS 33%

    emc · networkerSep 4, 2012

  • CVE-2011-4451
    40Plan

    libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP c

    MediumCVSS 4.3WeaponizedEPSS 14%

    wikkawiki · wikkawikiSep 5, 2012

  • CVE-2012-4869
    51Plan

    The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitr

    HighCVSS 7.5WeaponizedEPSS 70%

    sangoma · freepbxSep 6, 2012

  • CVE-2012-4876
    61This week

    Stack-based buffer overflow in the UltraMJCam ActiveX Control in TRENDnet SecurView TV-IP121WN Wireless Internet Camera allows remote attack

    CriticalCVSS 10.0WeaponizedEPSS 71%

    trendnet · securview wireless internet camera activex controlSep 6, 2012

  • CVE-2012-1892
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Visual Studio Team Foundation Server 2010 SP1 allows remote attackers to inject arbitr

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · visual studio team foundation serverSep 11, 2012

  • CVE-2012-2536
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Systems Management Server 2003 SP3 and System Center Configuration Manager 2007 SP2 al

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · system center configuration managerSep 11, 2012

  • CVE-2012-2982
    45Plan

    file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a path

    MediumCVSS 6.5WeaponizedEPSS 62%

    gentoo · webminSep 11, 2012

  • CVE-2012-2983
    40Plan

    file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allo

    MediumCVSS 5.0WeaponizedEPSS 20%

    gentoo · webminSep 11, 2012

  • CVE-2012-3955
    34Monitor

    ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunis

    HighCVSS 7.1No exploitEPSS 21%

    isc · dhcpSep 14, 2012

  • CVE-2012-4244
    42Plan

    ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attac

    HighCVSS 7.8No exploitEPSS 36%

    isc · bindSep 14, 2012

  • CVE-2011-5164
    46Plan

    Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute arbitrary code via a c

    CriticalCVSS 9.3WeaponizedEPSS 28%

    vandyke · absoluteftpSep 15, 2012

  • CVE-2011-5165
    48Plan

    Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted remote attackers to exe

    CriticalCVSS 9.3WeaponizedEPSS 37%

    cleanersoft · free mp3 cd ripperSep 15, 2012

  • CVE-2011-5170
    47Plan

    Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code via a long track name

    CriticalCVSS 9.3WeaponizedEPSS 31%

    castillobueno · ccmplayerSep 15, 2012

  • CVE-2011-5171
    51Plan

    Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary cod

    CriticalCVSS 9.3WeaponizedEPSS 45%

    cyberlink · power2goSep 15, 2012

  • CVE-2012-4924
    48Plan

    Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers

    CriticalCVSS 9.3WeaponizedEPSS 36%

    asus · ipswcom activex componentSep 15, 2012

  • CVE-2012-4969
    86Now

    Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attacker

    HighCVSS 8.1KEVWeaponizedEPSS 80%

    microsoft · internet explorerSep 18, 2012

  • CVE-2012-1184
    35Monitor

    Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows

    HighCVSS 7.5Proof of conceptEPSS 16%

    digium · asteriskSep 18, 2012

  • CVE-2012-0271
    45Plan

    Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 201

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    novell · groupwiseSep 19, 2012

  • CVE-2012-4992
    41Plan

    Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode stri

    CriticalCVSS 9.0Proof of conceptEPSS 17%

    flashfxp · flashfxpSep 19, 2012

  • CVE-2012-5002
    40Plan

    Stack-based buffer overflow in SR10 FTP server (SR10.exe) 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enabl

    MediumCVSS 6.8WeaponizedEPSS 31%

    ricoh · dl-10Sep 19, 2012

  • CVE-2011-5181
    20Monitor

    Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attac

    MediumCVSS 4.3Proof of conceptEPSS 10%

    clickdesk · clickdesk live support-live chat pluginSep 20, 2012

  • CVE-2012-1529
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerSep 21, 2012

  • CVE-2012-2546
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerSep 21, 2012

  • CVE-2012-2548
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerSep 21, 2012

  • CVE-2012-2557
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerSep 21, 2012

  • CVE-2012-3137
    34Monitor

    The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers

    MediumCVSS 6.4Proof of conceptEPSS 31%

    oracle · database serverSep 21, 2012

  • CVE-2012-5054
    71This week

    Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to exec

    HighCVSS 8.8KEVWeaponizedEPSS 21%

    adobe · flash playerSep 24, 2012

  • CVE-2012-3259
    58Plan

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknow

    CriticalCVSS 10.0No exploitEPSS 60%

    hp · sitescopeSep 25, 2012

  • CVE-2012-3260
    52Plan

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknow

    CriticalCVSS 10.0WeaponizedEPSS 40%

    hp · sitescopeSep 25, 2012

  • CVE-2012-3261
    52Plan

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknow

    CriticalCVSS 10.0WeaponizedEPSS 40%

    hp · sitescopeSep 25, 2012

  • CVE-2012-0209
    52Plan

    Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2

    HighCVSS 7.5WeaponizedEPSS 71%

    horde · groupwareSep 25, 2012

  • CVE-2012-5159
    52Plan

    phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced

    HighCVSS 7.5WeaponizedEPSS 74%

    phpmyadmin · phpmyadminSep 25, 2012

  • CVE-2012-2897
    38Monitor

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2

    HighCVSS 7.8No exploitEPSS 21%

    microsoft · windows 7Sep 26, 2012

  • CVE-2012-0419
    40Plan

    Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1

    MediumCVSS 5.0WeaponizedEPSS 42%

    novell · groupwiseSep 28, 2012

  • CVE-2012-4415
    34Monitor

    Stack-based buffer overflow in the guac_client_plugin_open function in libguac in Guacamole before 0.6.3 allows remote attackers to cause a

    HighCVSS 7.5Proof of conceptEPSS 13%

    fedoraproject · fedoraSep 30, 2012