Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2012

33 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-5223
    42Plan

    The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers

    HighCVSS 7.5WeaponizedEPSS 40%

    crawlability · vbseoOct 1, 2012

  • CVE-2012-1153
    40Plan

    Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute

    MediumCVSS 6.8WeaponizedEPSS 32%

    apprain · apprainOct 6, 2012

  • CVE-2012-5306
    41Plan

    Stack-based buffer overflow in the SelectDirectory method in DcsCliCtrl.dll in Camera Stream Client ActiveX Control, as used in D-Link DCS-5

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    dlink · camera stream client activex controlOct 6, 2012

  • CVE-2010-5278
    23Monitor

    Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when ma

    MediumCVSS 4.3Proof of conceptEPSS 18%

    modx · modx revolutionOct 7, 2012

  • CVE-2012-1125
    30Monitor

    Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows r

    MediumCVSS 6.8Proof of conceptEPSS 11%

    wordpress · wordpressOct 8, 2012

  • CVE-2011-4342
    33Monitor

    PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to ex

    HighCVSS 7.5Proof of conceptEPSS 10%

    backwpup · backwpupOct 8, 2012

  • CVE-2011-4929
    44Plan

    Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitr

    HighCVSS 7.5WeaponizedEPSS 46%

    redmine · redmineOct 8, 2012

  • CVE-2012-5321
    27Monitor

    tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishi

    MediumCVSS 5.8Proof of conceptEPSS 13%

    tiki · tikiwiki cms\/groupwareOct 8, 2012

  • CVE-2012-0182
    57Plan

    Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 68%

    microsoft · wordOct 9, 2012

  • CVE-2012-2520
    27Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Atten

    MediumCVSS 4.3No exploitEPSS 34%

    microsoft · groove serverOct 9, 2012

  • CVE-2012-2528
    44Plan

    Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3;

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · word automation servicesOct 9, 2012

  • CVE-2012-2550
    44Plan

    Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted Word

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · worksOct 9, 2012

  • CVE-2012-2551
    28Monitor

    The server in Kerberos in Microsoft Windows Server 2008 R2 and R2 SP1, and Windows 7 Gold and SP1, allows remote attackers to cause a denial

    MediumCVSS 5.0No exploitEPSS 27%

    microsoft · windows 7Oct 9, 2012

  • CVE-2012-2552
    22Monitor

    Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · sql serverOct 9, 2012

  • CVE-2012-4399
    34Monitor

    The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing e

    HighCVSS 7.5Proof of conceptEPSS 12%

    cakefoundation · cakephpOct 9, 2012

  • CVE-2012-3993
    50Plan

    The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thun

    CriticalCVSS 9.3WeaponizedEPSS 42%

    mozilla · firefoxOct 10, 2012

  • CVE-2012-4186
    41Plan

    Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thu

    CriticalCVSS 9.3No exploitEPSS 14%

    mozilla · firefoxOct 10, 2012

  • CVE-2012-4188
    41Plan

    Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16

    CriticalCVSS 9.3No exploitEPSS 14%

    mozilla · firefoxOct 10, 2012

  • CVE-2012-5166
    41Plan

    ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attac

    HighCVSS 7.8No exploitEPSS 34%

    isc · bindOct 10, 2012

  • CVE-2012-1533
    61This week

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earl

    CriticalCVSS 10.0WeaponizedEPSS 69%

    oracle · jdkOct 16, 2012

  • CVE-2012-5067
    39Monitor

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers t

    MediumCVSS 5.0Proof of conceptEPSS 63%

    oracle · jdkOct 16, 2012

  • CVE-2012-5076
    96Now

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers t

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    oracle · jreOct 16, 2012

  • CVE-2012-5081
    40Plan

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier,

    MediumCVSS 5.0WeaponizedEPSS 45%

    oracle · jdkOct 16, 2012

  • CVE-2012-5088
    64This week

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers t

    CriticalCVSS 10.0WeaponizedEPSS 78%

    oracle · jreOct 16, 2012

  • CVE-2012-0518
    60This week

    Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote att

    MediumCVSS 4.7KEVWeaponizedEPSS 4%

    oracle · fusion middlewareOct 16, 2012

  • CVE-2012-3152
    96Now

    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remo

    CriticalCVSS 9.1KEVWeaponizedEPSS 98%

    oracle · fusion middlewareOct 16, 2012

  • CVE-2012-3153
    54Plan

    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remo

    MediumCVSS 6.4WeaponizedEPSS 98%

    oracle · fusion middlewareOct 16, 2012

  • CVE-2012-4933
    44Plan

    The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard

    HighCVSS 7.8WeaponizedEPSS 44%

    novell · zenworks asset managementOct 20, 2012

  • CVE-2012-3001
    42Plan

    Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command

    HighCVSS 8.5WeaponizedEPSS 27%

    mutiny · standardOct 22, 2012

  • CVE-2012-5672
    21Monitor

    Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of servi

    MediumCVSS 4.3Proof of conceptEPSS 12%

    microsoft · excelOct 25, 2012

  • CVE-2011-5227
    63This week

    Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote

    CriticalCVSS 10.0WeaponizedEPSS 76%

    enterasys · netsightOct 25, 2012

  • CVE-2012-5692
    48Plan

    Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impac

    CriticalCVSS 10.0WeaponizedEPSS 26%

    invisioncommunity · invision power boardOct 31, 2012

  • CVE-2012-4940
    51Plan

    Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or de

    MediumCVSS 6.4WeaponizedEPSS 85%

    gecad · axigen free mail serverOct 31, 2012