By publication date

Exploited and new serious CVEs: November 2012

47 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
45Plan	CVE-2012-5409Proof of concept	AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethesiemens · sipass integrated · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	15.7%	Nov 1, 2012
52Plan	CVE-2012-5687Weaponized	Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.tp-link · tl-wr841n · CWE-22 Pre-auth Path traversal	High7.8	—	68.7%	Nov 1, 2012
25Monitor	CVE-2012-3748Proof of concept	Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a deniapple · safari · CWE-362 pre-auth RCE Race condition	Medium5.1	—	16.6%	Nov 3, 2012
43Plan	CVE-2012-5274No exploit	Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x badobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	10.5%	Nov 7, 2012
43Plan	CVE-2012-5275No exploit	Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x badobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	10.5%	Nov 7, 2012
43Plan	CVE-2012-5276No exploit	Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x badobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	10.5%	Nov 7, 2012
43Plan	CVE-2012-5277No exploit	Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x badobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	10.5%	Nov 7, 2012
43Plan	CVE-2012-5280No exploit	Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x badobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	10.9%	Nov 7, 2012
48Plan	CVE-2012-3752Weaponized	Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (appapple · quicktime · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	36.0%	Nov 9, 2012
48Plan	CVE-2012-3753Weaponized	Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of serviceapple · quicktime · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	35.0%	Nov 9, 2012
40Plan	CVE-2012-3755Proof of concept	Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application apple · quicktime · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.1%	Nov 9, 2012
29Monitor	CVE-2012-4513Proof of concept	khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memkde · kde · CWE-119 Pre-auth Memory safety	Medium6.4	—	12.5%	Nov 11, 2012
40Plan	CVE-2012-4554Weaponized	The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDdrupal · drupal · CWE-264 Pre-auth	Medium5.0	—	15.8%	Nov 11, 2012
31Monitor	CVE-2012-4564No exploit	ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crashlibtiff · libtiff pre-auth RCE	Medium6.8	—	13.5%	Nov 11, 2012
43Plan	CVE-2012-1527No exploit	Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2,microsoft · windows 7 · CWE-189 Pre-auth	Critical9.3	—	20.8%	Nov 13, 2012
43Plan	CVE-2012-1528No exploit	Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, microsoft · windows 7 · CWE-189 Pre-auth	Critical9.3	—	20.8%	Nov 13, 2012
43Plan	CVE-2012-1538No exploit	Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	21.3%	Nov 13, 2012
40Plan	CVE-2012-1539No exploit	Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka microsoft · internet explorer · CWE-399 pre-auth RCE	High8.1	—	25.3%	Nov 13, 2012
46Plan	CVE-2012-1885No exploit	Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibilimicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	29.2%	Nov 13, 2012
44Plan	CVE-2012-1886No exploit	Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allow remote attackers to microsoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	21.7%	Nov 13, 2012
45Plan	CVE-2012-1887No exploit	Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote atmicrosoft · excel · CWE-399 pre-auth RCE	Critical9.3	—	25.0%	Nov 13, 2012
44Plan	CVE-2012-1895No exploit	The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissiomicrosoft · .net framework · CWE-264 pre-auth RCE	Critical9.3	—	22.6%	Nov 13, 2012
27Monitor	CVE-2012-1896No exploit	Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote amicrosoft · .net framework · CWE-200 Pre-auth Info leak	Medium5.0	—	23.6%	Nov 13, 2012
33Monitor	CVE-2012-2532No exploit	Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a sessionmicrosoft · ftp service · CWE-200 pre-auth RCE Command injection Info leak	Medium5.0	—	41.9%	Nov 13, 2012
45Plan	CVE-2012-2543No exploit	Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pamicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	26.2%	Nov 13, 2012
42Plan	CVE-2012-4775No exploit	Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka microsoft · internet explorer · CWE-399 pre-auth RCE	High8.8	—	22.4%	Nov 13, 2012
44Plan	CVE-2012-4776No exploit	The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuratiomicrosoft · .net framework · CWE-20 pre-auth RCE	Critical9.3	—	24.7%	Nov 13, 2012
44Plan	CVE-2012-4777No exploit	The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permismicrosoft · .net framework · CWE-264 pre-auth RCE	Critical9.3	—	24.7%	Nov 13, 2012
35Monitor	CVE-2012-2619Proof of concept	The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Motorola, Nokia, Pantechbroadcom · bcm4325 · CWE-20 Pre-auth Denial of service	High7.8	—	12.8%	Nov 14, 2012
51Plan	CVE-2012-3569Weaponized	Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.vmware · ovf tool · CWE-134 pre-auth RCE	Critical9.3	—	47.7%	Nov 14, 2012
61This week	CVE-2012-5896Weaponized	The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Adquest · intrust pre-auth RCE	Critical10.0	—	68.6%	Nov 17, 2012
24Monitor	CVE-2012-5887No exploit	The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does notapache · tomcat · CWE-287 Pre-auth Auth bypass	Medium5.0	—	12.0%	Nov 17, 2012
51Plan	CVE-2012-4956Weaponized	Heap-based buffer overflow in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to execute arbitrary code via a large numbenovell · file reporter · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	37.7%	Nov 18, 2012
51Plan	CVE-2012-4957Weaponized	Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /Fnovell · file reporter · CWE-22 Pre-auth Path traversal	High7.8	—	67.6%	Nov 18, 2012
53Plan	CVE-2012-4958Weaponized	Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /Fnovell · file reporter · CWE-22 Pre-auth Path traversal	High7.8	—	73.5%	Nov 18, 2012
61This week	CVE-2012-4959Weaponized	Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 13novell · file reporter · CWE-22 Pre-auth Path traversal	Critical10.0	—	71.1%	Nov 18, 2012
34Monitor	CVE-2012-4433No exploit	Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denigegl · gegl · CWE-189 pre-auth RCE	High7.5	—	13.2%	Nov 18, 2012
40Plan	CVE-2012-5519Weaponized	CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cupdebian · debian linux · CWE-264	High7.2	—	2.1%	Nov 19, 2012
40Plan	CVE-2012-4202No exploit	Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, mozilla · firefox · CWE-787 pre-auth RCE Memory safety	Critical9.3	—	11.0%	Nov 21, 2012
32Monitor	CVE-2012-4409Proof of concept	Stack-based buffer overflow in the check_file_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to mcrypt · mcrypt · CWE-119 pre-auth RCE Memory safety	Medium6.8	—	15.1%	Nov 21, 2012
44Plan	CVE-2012-5862Proof of concept	Sinapsi eSolar Hard-Coded Passwordsinapsitech · sinapsi firmware · CWE-259 Pre-auth Hard-coded credentials	Critical10.0	—	12.0%	Nov 23, 2012
47Plan	CVE-2012-5863Proof of concept	Sinapsi eSolar OS Command Injectionsinapsitech · sinapsi firmware · CWE-78 pre-auth RCE Command injection	Critical10.0	—	24.8%	Nov 23, 2012
24Monitor	CVE-2012-5533Proof of concept	The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite lighttpd · lighttpd · CWE-399 Pre-auth Denial of service	Medium5.0	—	12.0%	Nov 24, 2012
23Monitor	CVE-2012-0698Proof of concept	tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP trustedcomputinggroup · trousers · CWE-119 Pre-auth Memory safety Denial of service	Medium5.0	—	10.5%	Nov 26, 2012
44Plan	CVE-2010-5286Proof of concept	Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly joomla · joomla\! · CWE-22 Pre-auth Path traversal	Critical10.0	—	12.1%	Nov 26, 2012
25Monitor	CVE-2012-4557No exploit	The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long rapache · http server · CWE-399 Pre-auth Denial of service	Medium5.0	—	17.4%	Nov 30, 2012
34Monitor	CVE-2012-4562No exploit	Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly libssh · libssh · CWE-189 pre-auth RCE	High7.5	—	12.8%	Nov 30, 2012

CVE-2012-5409
45Plan
AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethe
CriticalCVSS 10.0Proof of conceptEPSS 15%
- pre-auth RCE
- Memory safety
siemens · sipass integratedNov 1, 2012
CVE-2012-5687
52Plan
Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.
HighCVSS 7.8WeaponizedEPSS 68%
- Pre-auth
- Path traversal
tp-link · tl-wr841nNov 1, 2012
CVE-2012-3748
25Monitor
Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a deni
MediumCVSS 5.1Proof of conceptEPSS 16%
- pre-auth RCE
- Race condition
apple · safariNov 3, 2012
CVE-2012-5274
43Plan
Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x b
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · flash playerNov 7, 2012
CVE-2012-5275
43Plan
Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x b
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · flash playerNov 7, 2012
CVE-2012-5276
43Plan
Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x b
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · flash playerNov 7, 2012
CVE-2012-5277
43Plan
Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x b
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · flash playerNov 7, 2012
CVE-2012-5280
43Plan
Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x b
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · flash playerNov 7, 2012
CVE-2012-3752
48Plan
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (app
CriticalCVSS 9.3WeaponizedEPSS 36%
- pre-auth RCE
- Memory safety
apple · quicktimeNov 9, 2012
CVE-2012-3753
48Plan
Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service
CriticalCVSS 9.3WeaponizedEPSS 35%
- pre-auth RCE
- Memory safety
apple · quicktimeNov 9, 2012
CVE-2012-3755
40Plan
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application
CriticalCVSS 9.3Proof of conceptEPSS 10%
- pre-auth RCE
- Memory safety
apple · quicktimeNov 9, 2012
CVE-2012-4513
29Monitor
khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read mem
MediumCVSS 6.4Proof of conceptEPSS 12%
- Pre-auth
- Memory safety
kde · kdeNov 11, 2012
CVE-2012-4554
40Plan
The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRD
MediumCVSS 5.0WeaponizedEPSS 15%
- Pre-auth
drupal · drupalNov 11, 2012
CVE-2012-4564
31Monitor
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash
MediumCVSS 6.8No exploitEPSS 13%
- pre-auth RCE
libtiff · libtiffNov 11, 2012
CVE-2012-1527
43Plan
Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2,
CriticalCVSS 9.3No exploitEPSS 20%
- Pre-auth
microsoft · windows 7Nov 13, 2012
CVE-2012-1528
43Plan
Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2,
CriticalCVSS 9.3No exploitEPSS 20%
- Pre-auth
microsoft · windows 7Nov 13, 2012
CVE-2012-1538
43Plan
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
microsoft · internet explorerNov 13, 2012
CVE-2012-1539
40Plan
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka
HighCVSS 8.1No exploitEPSS 25%
- pre-auth RCE
microsoft · internet explorerNov 13, 2012
CVE-2012-1885
46Plan
Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibili
CriticalCVSS 9.3No exploitEPSS 29%
- pre-auth RCE
- Memory safety
microsoft · excelNov 13, 2012
CVE-2012-1886
44Plan
Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allow remote attackers to
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · excelNov 13, 2012
CVE-2012-1887
45Plan
Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote at
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
microsoft · excelNov 13, 2012
CVE-2012-1895
44Plan
The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissio
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · .net frameworkNov 13, 2012
CVE-2012-1896
27Monitor
Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote a
MediumCVSS 5.0No exploitEPSS 23%
- Pre-auth
- Info leak
microsoft · .net frameworkNov 13, 2012
CVE-2012-2532
33Monitor
Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session
MediumCVSS 5.0No exploitEPSS 41%
- pre-auth RCE
- Command injection
- Info leak
microsoft · ftp serviceNov 13, 2012
CVE-2012-2543
45Plan
Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pa
CriticalCVSS 9.3No exploitEPSS 26%
- pre-auth RCE
- Memory safety
microsoft · excelNov 13, 2012
CVE-2012-4775
42Plan
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka
HighCVSS 8.8No exploitEPSS 22%
- pre-auth RCE
microsoft · internet explorerNov 13, 2012
CVE-2012-4776
44Plan
The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuratio
CriticalCVSS 9.3No exploitEPSS 24%
- pre-auth RCE
microsoft · .net frameworkNov 13, 2012
CVE-2012-4777
44Plan
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permis
CriticalCVSS 9.3No exploitEPSS 24%
- pre-auth RCE
microsoft · .net frameworkNov 13, 2012
CVE-2012-2619
35Monitor
The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Motorola, Nokia, Pantech
HighCVSS 7.8Proof of conceptEPSS 12%
- Pre-auth
- Denial of service
broadcom · bcm4325Nov 14, 2012
CVE-2012-3569
51Plan
Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.
CriticalCVSS 9.3WeaponizedEPSS 47%
- pre-auth RCE
vmware · ovf toolNov 14, 2012
CVE-2012-5896
61This week
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Ad
CriticalCVSS 10.0WeaponizedEPSS 68%
- pre-auth RCE
quest · intrustNov 17, 2012
CVE-2012-5887
24Monitor
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not
MediumCVSS 5.0No exploitEPSS 12%
- Pre-auth
- Auth bypass
apache · tomcatNov 17, 2012
CVE-2012-4956
51Plan
Heap-based buffer overflow in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to execute arbitrary code via a large numbe
CriticalCVSS 10.0WeaponizedEPSS 37%
- pre-auth RCE
- Memory safety
novell · file reporterNov 18, 2012
CVE-2012-4957
51Plan
Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /F
HighCVSS 7.8WeaponizedEPSS 67%
- Pre-auth
- Path traversal
novell · file reporterNov 18, 2012
CVE-2012-4958
53Plan
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /F
HighCVSS 7.8WeaponizedEPSS 73%
- Pre-auth
- Path traversal
novell · file reporterNov 18, 2012
CVE-2012-4959
61This week
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 13
CriticalCVSS 10.0WeaponizedEPSS 71%
- Pre-auth
- Path traversal
novell · file reporterNov 18, 2012
CVE-2012-4433
34Monitor
Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a deni
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
gegl · geglNov 18, 2012
CVE-2012-5519
40Plan
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cup
HighCVSS 7.2WeaponizedEPSS 2%
debian · debian linuxNov 19, 2012
CVE-2012-4202
40Plan
Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11,
CriticalCVSS 9.3No exploitEPSS 11%
- pre-auth RCE
- Memory safety
mozilla · firefoxNov 21, 2012
CVE-2012-4409
32Monitor
Stack-based buffer overflow in the check_file_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to
MediumCVSS 6.8Proof of conceptEPSS 15%
- pre-auth RCE
- Memory safety
mcrypt · mcryptNov 21, 2012
CVE-2012-5862
44Plan
Sinapsi eSolar Hard-Coded Password
CriticalCVSS 10.0Proof of conceptEPSS 12%
- Pre-auth
- Hard-coded credentials
sinapsitech · sinapsi firmwareNov 23, 2012
CVE-2012-5863
47Plan
Sinapsi eSolar OS Command Injection
CriticalCVSS 10.0Proof of conceptEPSS 24%
- pre-auth RCE
- Command injection
sinapsitech · sinapsi firmwareNov 23, 2012
CVE-2012-5533
24Monitor
The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite
MediumCVSS 5.0Proof of conceptEPSS 12%
- Pre-auth
- Denial of service
lighttpd · lighttpdNov 24, 2012
CVE-2012-0698
23Monitor
tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP
MediumCVSS 5.0Proof of conceptEPSS 10%
- Pre-auth
- Memory safety
- Denial of service
trustedcomputinggroup · trousersNov 26, 2012
CVE-2010-5286
44Plan
Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly
CriticalCVSS 10.0Proof of conceptEPSS 12%
- Pre-auth
- Path traversal
joomla · joomla\!Nov 26, 2012
CVE-2012-4557
25Monitor
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long r
MediumCVSS 5.0No exploitEPSS 17%
- Pre-auth
- Denial of service
apache · http serverNov 30, 2012
CVE-2012-4562
34Monitor
Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly
HighCVSS 7.5No exploitEPSS 12%
- pre-auth RCE
libssh · libsshNov 30, 2012