Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2013

48 records · 5 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2013-1338
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMay 1, 2013

  • CVE-2013-1847
    35Monitor

    The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a den

    MediumCVSS 5.0Proof of conceptEPSS 51%

    apache · subversionMay 2, 2013

  • CVE-2013-1884
    35Monitor

    The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentat

    MediumCVSS 5.0Proof of conceptEPSS 50%

    apache · subversionMay 2, 2013

  • CVE-2013-0726
    45Plan

    Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 13.00.0001 allows rem

    CriticalCVSS 9.3WeaponizedEPSS 27%

    hexagon · erdas er viewerMay 5, 2013

  • CVE-2013-1347
    88Now

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    HighCVSS 8.8KEVWeaponizedEPSS 77%

    microsoft · internet explorerMay 5, 2013

  • CVE-2013-3502
    42Plan

    monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary comm

    MediumCVSS 6.5WeaponizedEPSS 53%

    gwos · groundwork monitorMay 8, 2013

  • CVE-2013-3336
    42Plan

    Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.

    MediumCVSS 5.0WeaponizedEPSS 74%

    adobe · coldfusionMay 9, 2013

  • CVE-2013-0946
    46Plan

    Buffer overflow in the Library Control Program (LCP) in EMC AlphaStor 4.0 before build 910 allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3Proof of conceptEPSS 28%

    emc · alphastorMay 10, 2013

  • CVE-2013-3522
    40Plan

    SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authe

    MediumCVSS 6.5WeaponizedEPSS 27%

    vbulletin · vbulletinMay 10, 2013

  • CVE-2013-3526
    21Monitor

    Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress al

    MediumCVSS 4.3Proof of conceptEPSS 13%

    wordpress · wordpressMay 10, 2013

  • CVE-2013-2094
    77This week

    The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows lo

    HighCVSS 8.4KEVWeaponizedEPSS 47%

    linux · linux kernelMay 14, 2013

  • CVE-2013-0096
    36Monitor

    Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via craf

    MediumCVSS 6.8No exploitEPSS 30%

    microsoft · windows essentialsMay 14, 2013

  • CVE-2013-0811
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1297
    22Monitor

    Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-d

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1301
    22Monitor

    Microsoft Visio 2003 SP3 2007 SP3, and 2010 SP1 allows remote attackers to read arbitrary files via an XML document containing an external e

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · visioMay 14, 2013

  • CVE-2013-1302
    44Plan

    Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows r

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · lyncMay 14, 2013

  • CVE-2013-1305
    47Plan

    HTTP.sys in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (infinite loop) vi

    HighCVSS 7.8No exploitEPSS 54%

    microsoft · windows 8May 14, 2013

  • CVE-2013-1306
    47Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1307
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1308
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1309
    49Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web

    CriticalCVSS 9.3Proof of conceptEPSS 39%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1310
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via a crafted web site

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1311
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1312
    43Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sit

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMay 14, 2013

  • CVE-2013-1316
    44Plan

    Microsoft Publisher 2003 SP3 does not properly validate the size of an unspecified array, which allows remote attackers to execute arbitrary

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1317
    43Plan

    Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that trigger

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1318
    48Plan

    Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers access to an inval

    CriticalCVSS 10.0No exploitEPSS 26%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1319
    48Plan

    Microsoft Publisher 2003 SP3 does not properly check the return value of an unspecified method, which allows remote attackers to execute arb

    CriticalCVSS 10.0No exploitEPSS 25%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1320
    49Plan

    Buffer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publish

    CriticalCVSS 10.0No exploitEPSS 29%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1321
    44Plan

    Microsoft Publisher 2003 SP3 does not properly check the data type of an unspecified return value, which allows remote attackers to execute

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1322
    48Plan

    Microsoft Publisher 2003 SP3 does not properly check table range data, which allows remote attackers to execute arbitrary code via a crafted

    CriticalCVSS 10.0No exploitEPSS 25%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1323
    43Plan

    Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items, which allows remote attackers to execute arbit

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1327
    43Plan

    Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1328
    43Plan

    Microsoft Publisher 2003 SP3, 2007 SP3, and 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Publisher file that tri

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1329
    43Plan

    Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · publisherMay 14, 2013

  • CVE-2013-1335
    43Plan

    Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code via crafted shape data in a Word document, aka "Wor

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · wordMay 14, 2013

  • CVE-2013-1336
    26Monitor

    The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check signatures, which allo

    MediumCVSS 5.0No exploitEPSS 19%

    microsoft · .net frameworkMay 14, 2013

  • CVE-2013-1337
    36Monitor

    Microsoft .NET Framework 4.5 does not properly create policy requirements for custom Windows Communication Foundation (WCF) endpoint authent

    HighCVSS 7.5No exploitEPSS 20%

    microsoft · .net frameworkMay 14, 2013

  • CVE-2013-1346
    40Plan

    mpengine.dll in Microsoft Malware Protection Engine before 1.1.9506.0 on x64 platforms allows remote attackers to execute arbitrary code or

    CriticalCVSS 9.3No exploitEPSS 11%

    microsoft · malware protection engineMay 15, 2013

  • CVE-2013-1670
    20Monitor

    The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, an

    MediumCVSS 4.3Proof of conceptEPSS 10%

    mozilla · firefoxMay 16, 2013

  • CVE-2013-1675
    60This week

    Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not proper

    MediumCVSS 6.5KEVWeaponizedEPSS 6%

    mozilla · firefoxMay 16, 2013

  • CVE-2013-2729
    89Now

    Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbit

    CriticalCVSS 9.8KEVWeaponizedEPSS 66%

    adobe · acrobatMay 16, 2013

  • CVE-2013-2730
    64This week

    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitr

    CriticalCVSS 10.0WeaponizedEPSS 78%

    adobe · acrobat readerMay 16, 2013

  • CVE-2013-2842
    34Monitor

    Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unsp

    HighCVSS 7.5Proof of conceptEPSS 11%

    google · chromeMay 22, 2013

  • CVE-2012-6554
    40Plan

    functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code

    MediumCVSS 6.5WeaponizedEPSS 16%

    a51dev · activecollab chat moduleMay 23, 2013

  • CVE-2011-4518
    28Monitor

    Directory traversal vulnerability in the PmWebDir object in the web server in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to read

    MediumCVSS 5.0Proof of conceptEPSS 26%

    microsys · promoticMay 23, 2013

  • CVE-2013-1017
    47Plan

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application

    CriticalCVSS 9.3WeaponizedEPSS 32%

    apple · quicktimeMay 24, 2013

  • CVE-2013-3660
    73This week

    The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,

    HighCVSS 7.8KEVWeaponizedEPSS 39%

    microsoft · windows 7May 24, 2013