Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2013

18 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2013-1899
    42Plan

    Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to ca

    MediumCVSS 6.5WeaponizedEPSS 54%

    postgresql · postgresqlApr 4, 2013

  • CVE-2013-0680
    40Plan

    Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade Da

    HighCVSS 7.5WeaponizedEPSS 18%

    cogentdatahub · cogent datahubApr 5, 2013

  • CVE-2013-0109
    40Plan

    The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not properly handle exc

    HighCVSS 7.2WeaponizedEPSS 4%

    nvidia · display driverApr 8, 2013

  • CVE-2013-1282
    28Monitor

    The LDAP service in Microsoft Active Directory, Active Directory Application Mode (ADAM), Active Directory Lightweight Directory Service (AD

    MediumCVSS 5.0No exploitEPSS 27%

    microsoft · active directoryApr 9, 2013

  • CVE-2013-1289
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, an

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · groove serverApr 9, 2013

  • CVE-2013-1290
    19Monitor

    Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls f

    LowCVSS 3.5No exploitEPSS 16%

    microsoft · sharepoint serverApr 9, 2013

  • CVE-2013-1296
    43Plan

    The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · remote desktop connectionApr 9, 2013

  • CVE-2013-1303
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerApr 9, 2013

  • CVE-2013-1304
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerApr 9, 2013

  • CVE-2013-2596
    62This week

    Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of A

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    linux · linux kernelApr 12, 2013

  • CVE-2013-1559
    40Plan

    Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote auth

    MediumCVSS 4.0WeaponizedEPSS 58%

    oracle · fusion middlewareApr 17, 2013

  • CVE-2013-2419
    27Monitor

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier

    MediumCVSS 5.0Proof of conceptEPSS 22%

    oracle · jreApr 17, 2013

  • CVE-2013-2423
    70This week

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows r

    LowCVSS 3.7KEVWeaponizedEPSS 85%

    oracle · jreApr 17, 2013

  • CVE-2013-3075
    43Plan

    Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities 7.10 and CitectScad

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    mitsubishi-automation · mitsubishi mx componentApr 19, 2013

  • CVE-2013-0233
    40Plan

    Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does n

    MediumCVSS 6.8WeaponizedEPSS 14%

    plataformatec · deviseApr 25, 2013

  • CVE-2013-3238
    40Plan

    phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, wh

    MediumCVSS 6.0WeaponizedEPSS 28%

    phpmyadmin · phpmyadminApr 25, 2013

  • CVE-2013-1428
    44Plan

    Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote aut

    MediumCVSS 6.5WeaponizedEPSS 60%

    tinc-vpn · tincApr 26, 2013

  • CVE-2012-5946
    47Plan

    Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbi

    CriticalCVSS 9.3WeaponizedEPSS 33%

    ibm · spss samplepowerApr 29, 2013