Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2013

57 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-1541
    43Plan

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allo

    CriticalCVSS 10.0No exploitEPSS 10%

    oracle · jreFeb 1, 2013

  • CVE-2012-0874
    32Monitor

    The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Pl

    MediumCVSS 6.8Proof of conceptEPSS 15%

    redhat · jboss enterprise application platformFeb 5, 2013

  • CVE-2012-3282
    45Plan

    Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitr

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    hp · san\/iqFeb 6, 2013

  • CVE-2012-3283
    43Plan

    Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitr

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · san\/iqFeb 6, 2013

  • CVE-2013-0633
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x b

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    adobe · flash playerFeb 8, 2013

  • CVE-2013-0634
    60This week

    Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262

    CriticalCVSS 9.3WeaponizedEPSS 77%

    adobe · flash playerFeb 8, 2013

  • CVE-2012-2686
    40Plan

    crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows re

    MediumCVSS 5.0WeaponizedEPSS 39%

    openssl · opensslFeb 8, 2013

  • CVE-2013-0166
    26Monitor

    OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, whi

    MediumCVSS 5.0No exploitEPSS 19%

    openssl · opensslFeb 8, 2013

  • CVE-2013-0169
    21Monitor

    The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly c

    LowCVSS 2.6Proof of conceptEPSS 35%

    openssl · opensslFeb 8, 2013

  • CVE-2013-0189
    27Monitor

    cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (res

    MediumCVSS 5.0No exploitEPSS 23%

    squid-cache · squidFeb 8, 2013

  • CVE-2013-0639
    44Plan

    Integer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.6

    CriticalCVSS 10.0No exploitEPSS 12%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-0642
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-0645
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1365
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1366
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1367
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1368
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1369
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1370
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1372
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-1373
    43Plan

    Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.60

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · flash playerFeb 12, 2013

  • CVE-2013-0269
    34Monitor

    The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resourc

    HighCVSS 7.5Proof of conceptEPSS 13%

    rubygems · json gemFeb 12, 2013

  • CVE-2013-0015
    22Monitor

    Microsoft Internet Explorer 6 through 9 does not properly perform auto-selection of the Shift JIS encoding, which allows remote attackers to

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0018
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0019
    47Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3Proof of conceptEPSS 34%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0020
    45Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0021
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0022
    41Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.0No exploitEPSS 16%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0023
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sit

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0024
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0025
    54Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3WeaponizedEPSS 55%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0026
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0027
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0028
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0029
    39Monitor

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web

    HighCVSS 7.5No exploitEPSS 30%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0030
    45Plan

    The Vector Markup Language (VML) implementation in Microsoft Internet Explorer 6 through 10 does not properly allocate buffers, which allows

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · internet explorerFeb 13, 2013

  • CVE-2013-0073
    49Plan

    The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly restrict the privil

    CriticalCVSS 10.0No exploitEPSS 29%

    microsoft · .net frameworkFeb 13, 2013

  • CVE-2013-0075
    52Plan

    The TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Window

    HighCVSS 7.8No exploitEPSS 69%

    microsoft · windows vistaFeb 13, 2013

  • CVE-2013-0077
    46Plan

    Quartz.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to exe

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · windows server 2003Feb 13, 2013

  • CVE-2013-1281
    35Monitor

    The NFS server in Microsoft Windows Server 2008 R2 and R2 SP1 and Server 2012 allows remote attackers to cause a denial of service (NULL poi

    HighCVSS 7.1No exploitEPSS 23%

    microsoft · windows server 2008Feb 13, 2013

  • CVE-2013-1313
    44Plan

    Object Linking and Embedding (OLE) Automation in Microsoft Windows XP SP3 does not properly allocate memory, which allows remote attackers t

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · windows xpFeb 13, 2013

  • CVE-2012-3363
    51Plan

    Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows re

    CriticalCVSS 9.1Proof of conceptEPSS 49%

    zend · zend frameworkFeb 13, 2013

  • CVE-2013-1114
    20Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unity Express before 8.0 allow remote attackers to inject arbitrary web script

    MediumCVSS 4.3Proof of conceptEPSS 10%

    cisco · unity express softwareFeb 13, 2013

  • CVE-2013-0640
    87Now

    Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or c

    HighCVSS 7.8KEVWeaponizedEPSS 86%

    adobe · acrobatFeb 13, 2013

  • CVE-2013-0641
    71This week

    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute

    HighCVSS 7.8KEVWeaponizedEPSS 32%

    adobe · acrobatFeb 13, 2013

  • CVE-2012-4711
    58Plan

    Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.e

    CriticalCVSS 10.0WeaponizedEPSS 60%

    wellintech · kingviewFeb 15, 2013

  • CVE-2013-0658
    46Plan

    Heap-based buffer overflow in RFManagerService.exe in Schneider Electric Accutech Manager 2.00.1 and earlier allows remote attackers to exec

    CriticalCVSS 10.0Proof of conceptEPSS 21%

    schneider-electric · accutech managerFeb 15, 2013

  • CVE-2012-0439
    49Plan

    An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to e

    CriticalCVSS 9.3WeaponizedEPSS 39%

    novell · groupwiseFeb 24, 2013

  • CVE-2013-0804
    44Plan

    The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a den

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    novell · groupwiseFeb 24, 2013

  • CVE-2012-4705
    59Plan

    Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors

    CriticalCVSS 10.0WeaponizedEPSS 64%

    3s-software · codesys gateway-serverFeb 24, 2013

  • CVE-2012-6274
    40Plan

    BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary fi

    MediumCVSS 5.0WeaponizedEPSS 46%

    bigantsoft · bigant im message serverFeb 24, 2013

  • CVE-2012-6275
    54Plan

    Multiple stack-based buffer overflows in AntDS.exe in BigAntSoft BigAnt IM Message Server allow remote attackers to have an unspecified impa

    CriticalCVSS 10.0WeaponizedEPSS 46%

    bigantsoft · bigant im message serverFeb 24, 2013

  • CVE-2013-0108
    40Plan

    An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310

    MediumCVSS 6.8WeaponizedEPSS 26%

    honeywell · enterprise buildings integratorFeb 24, 2013

  • CVE-2012-3499
    24Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote at

    MediumCVSS 4.3No exploitEPSS 22%

    apache · http serverFeb 26, 2013

  • CVE-2012-4558
    24Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the

    MediumCVSS 4.3No exploitEPSS 22%

    apache · http serverFeb 26, 2013

  • CVE-2013-0643
    68This week

    The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 an

    HighCVSS 8.8KEVWeaponizedEPSS 10%

    adobe · flash playerFeb 26, 2013

  • CVE-2013-0648
    68This week

    Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.

    HighCVSS 8.8KEVWeaponizedEPSS 11%

    adobe · flash playerFeb 26, 2013