Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2013

58 records · 6 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-6081
    40Plan

    Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) act

    MediumCVSS 6.0WeaponizedEPSS 35%

    moinmo · moinmoinJan 2, 2013

  • CVE-2012-6495
    30Monitor

    Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions

    MediumCVSS 6.0Proof of conceptEPSS 18%

    moinmo · moinmoinJan 2, 2013

  • CVE-2012-6329
    49Plan

    The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and f

    HighCVSS 7.5WeaponizedEPSS 63%

    perl · perlJan 4, 2013

  • CVE-2012-6330
    31Monitor

    The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to c

    MediumCVSS 5.0Proof of conceptEPSS 35%

    twiki · twikiJan 4, 2013

  • CVE-2013-0625
    97Now

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    adobe · coldfusionJan 8, 2013

  • CVE-2013-0629
    80Now

    Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspeci

    HighCVSS 7.5KEVWeaponizedEPSS 65%

    adobe · coldfusionJan 8, 2013

  • CVE-2013-0631
    80Now

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in

    HighCVSS 7.5KEVWeaponizedEPSS 66%

    adobe · coldfusionJan 8, 2013

  • CVE-2013-0001
    21Monitor

    The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly init

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · .net frameworkJan 9, 2013

  • CVE-2013-0002
    45Plan

    Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4,

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · .net frameworkJan 9, 2013

  • CVE-2013-0003
    44Plan

    Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1,

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · .net frameworkJan 9, 2013

  • CVE-2013-0004
    43Plan

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · .net frameworkJan 9, 2013

  • CVE-2013-0005
    41Plan

    The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and th

    HighCVSS 7.8No exploitEPSS 32%

    microsoft · .net frameworkJan 9, 2013

  • CVE-2013-0006
    43Plan

    Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbi

    HighCVSS 8.8No exploitEPSS 28%

    microsoft · xml core servicesJan 9, 2013

  • CVE-2013-0007
    46Plan

    Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbi

    CriticalCVSS 9.3Proof of conceptEPSS 31%

    microsoft · xml core servicesJan 9, 2013

  • CVE-2013-0008
    40Plan

    win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windo

    HighCVSS 7.2WeaponizedEPSS 17%

    microsoft · windows vistaJan 9, 2013

  • CVE-2013-0009
    21Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arb

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · system center operations managerJan 9, 2013

  • CVE-2013-0010
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arb

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · system center operations managerJan 9, 2013

  • CVE-2013-0011
    49Plan

    The Print Spooler in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary cod

    CriticalCVSS 10.0No exploitEPSS 30%

    microsoft · windows 7Jan 9, 2013

  • CVE-2013-0613
    43Plan

    Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitr

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · acrobatJan 10, 2013

  • CVE-2013-0422
    98Now

    Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBean

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    oracle · jdkJan 10, 2013

  • CVE-2011-5252
    27Monitor

    Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x befo

    MediumCVSS 5.8Proof of conceptEPSS 11%

    orchardproject · orchardJan 12, 2013

  • CVE-2012-6499
    26Monitor

    Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to

    MediumCVSS 5.8Proof of conceptEPSS 10%

    wordpress · wordpressJan 12, 2013

  • CVE-2013-0753
    52Plan

    Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox

    CriticalCVSS 9.3WeaponizedEPSS 51%

    mozilla · firefoxJan 13, 2013

  • CVE-2013-0757
    55Plan

    The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Th

    CriticalCVSS 9.3WeaponizedEPSS 60%

    mozilla · firefoxJan 13, 2013

  • CVE-2013-0758
    59Plan

    Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before

    CriticalCVSS 9.3WeaponizedEPSS 73%

    mozilla · firefoxJan 13, 2013

  • CVE-2013-0156
    60This week

    active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1

    HighCVSS 7.5WeaponizedEPSS 99%

    rubyonrails · railsJan 13, 2013

  • CVE-2013-0632
    97Now

    administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitr

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    adobe · coldfusionJan 16, 2013

  • CVE-2012-5875
    23Monitor

    Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1) crafted Connection

    MediumCVSS 5.0Proof of conceptEPSS 10%

    fireflymediaserver · firefly media serverJan 18, 2013

  • CVE-2013-0657
    46Plan

    Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execut

    CriticalCVSS 10.0Proof of conceptEPSS 21%

    schneider-electric · interactive graphical scada systemJan 21, 2013

  • CVE-2013-0928
    47Plan

    The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execut

    CriticalCVSS 9.3WeaponizedEPSS 34%

    emc · alphastorJan 21, 2013

  • CVE-2012-6502
    13Monitor

    Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain

    LowCVSS 2.6No exploitEPSS 10%

    microsoft · internet explorerJan 22, 2013

  • CVE-2012-6096
    50Plan

    Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2,

    HighCVSS 7.5WeaponizedEPSS 66%

    nagios · nagiosJan 22, 2013

  • CVE-2013-0209
    44Plan

    lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migr

    HighCVSS 7.5WeaponizedEPSS 45%

    sixapart · movable typeJan 22, 2013

  • CVE-2011-4618
    20Monitor

    Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attacke

    MediumCVSS 4.3Proof of conceptEPSS 10%

    wordpress · wordpressJan 23, 2013

  • CVE-2012-6435
    40Plan

    Rockwell Automation ControlLogix PLC Improper Access Control

    HighCVSS 7.5No exploitEPSS 33%

    rockwellautomation · controllogix controllersJan 24, 2013

  • CVE-2012-6436
    38Monitor

    Rockwell Automation ControlLogix PLC Improper Input Validation

    HighCVSS 7.5No exploitEPSS 27%

    rockwellautomation · controllogix controllersJan 24, 2013

  • CVE-2012-6438
    38Monitor

    Rockwell Automation ControlLogix PLC Improper Input Validation

    HighCVSS 7.5No exploitEPSS 27%

    rockwellautomation · controllogix controllersJan 24, 2013

  • CVE-2012-6439
    41Plan

    Rockwell Automation ControlLogix PLC Improper Access Control

    HighCVSS 8.5No exploitEPSS 23%

    rockwellautomation · controllogix controllersJan 24, 2013

  • CVE-2012-6441
    37Monitor

    Rockwell Automation ControlLogix PLC Information Exposure

    MediumCVSS 5.0No exploitEPSS 57%

    rockwellautomation · controllogix controllersJan 24, 2013

  • CVE-2012-6442
    41Plan

    Rockwell Automation ControlLogix PLC Improper Access Control

    HighCVSS 7.5No exploitEPSS 35%

    rockwellautomation · ethernet\/ip firmwareJan 24, 2013

  • CVE-2012-5689
    32Monitor

    ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks

    HighCVSS 7.1No exploitEPSS 12%

    isc · bindJan 25, 2013

  • CVE-2012-3278
    43Plan

    Stack-based buffer overflow in magentservice.exe in HP Diagnostics Server 8.x through 8.07 and 9.x through 9.21 allows remote attackers to e

    CriticalCVSS 10.0No exploitEPSS 11%

    hp · diagnostics serverJan 25, 2013

  • CVE-2012-4914
    46Plan

    Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a c

    CriticalCVSS 9.3WeaponizedEPSS 28%

    coolpdf · coolpdfJan 26, 2013

  • CVE-2013-0653
    40Plan

    Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICI

    MediumCVSS 4.3WeaponizedEPSS 19%

    ge · intelligent platforms proficy hmi\/scada cimplicityJan 27, 2013

  • CVE-2013-1451
    22Monitor

    Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure

    MediumCVSS 4.0Proof of conceptEPSS 20%

    microsoft · internet explorerJan 29, 2013

  • CVE-2013-0333
    59Plan

    lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to

    HighCVSS 7.5WeaponizedEPSS 95%

    rubyonrails · railsJan 30, 2013

  • CVE-2012-6530
    42Plan

    Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folde

    HighCVSS 7.1WeaponizedEPSS 46%

    sysax · multi serverJan 31, 2013

  • CVE-2013-0431
    71This week

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-

    LowCVSS 3.7KEVWeaponizedEPSS 90%

    oracle · jreJan 31, 2013

  • CVE-2012-5958
    65This week

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0WeaponizedEPSS 83%

    libupnp project · libupnpJan 31, 2013

  • CVE-2012-5959
    63This week

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0WeaponizedEPSS 75%

    portable sdk for upnp project · portable sdk for upnpJan 31, 2013

  • CVE-2012-5960
    50Plan

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0Proof of conceptEPSS 32%

    portable sdk for upnp project · portable sdk for upnpJan 31, 2013

  • CVE-2012-5961
    51Plan

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    libupnp project · libupnpJan 31, 2013

  • CVE-2012-5962
    51Plan

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    portable sdk for upnp project · portable sdk for upnpJan 31, 2013

  • CVE-2012-5963
    51Plan

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    portable sdk for upnp project · portable sdk for upnpJan 31, 2013

  • CVE-2012-5964
    51Plan

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    portable sdk for upnp project · portable sdk for upnpJan 31, 2013

  • CVE-2012-5965
    51Plan

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    portable sdk for upnp project · portable sdk for upnpJan 31, 2013

  • CVE-2013-0229
    54Plan

    The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial

    HighCVSS 7.8WeaponizedEPSS 76%

    miniupnp project · miniupnpdJan 31, 2013

  • CVE-2013-0230
    61This week

    Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows

    CriticalCVSS 10.0WeaponizedEPSS 69%

    miniupnp project · miniupnpdJan 31, 2013