By publication date

Exploited and new serious CVEs: July 2013

69 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2013-2171Weaponized	The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properfreebsd · freebsd · CWE-264 Local privilege escalation	Medium6.9	—	6.9%	Jul 1, 2013
59Plan	CVE-2013-2343Weaponized	Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrhp · lefthand p4000 virtual san appliance pre-auth RCE	Critical10.0	—	61.8%	Jul 2, 2013
41Plan	CVE-2013-1960No exploit	Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause remotesensing · libtiff · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	11.8%	Jul 3, 2013
45Plan	CVE-2013-3563Weaponized	Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daelianja · lianja sql server · CWE-119 pre-auth RCE Memory safety	High7.5	—	49.4%	Jul 4, 2013
43Plan	CVE-2013-2340No exploit	Unspecified vulnerability on the HP ProCurve JC###A, JC###B, JD###A, JD###B, JE###A, JF###A, JF###B, JF###C, JG###A, 658250-B21, and 658247-hp · 3com baseline plus switch pre-auth RCE	Critical10.0	—	10.4%	Jul 6, 2013
40Plan	CVE-2013-0235Weaponized	The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attackwordpress · wordpress Pre-auth SSRF	Medium6.4	—	29.5%	Jul 8, 2013
48Plan	CVE-2013-4782Weaponized	The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suitesupermicro · bmc · CWE-287 pre-auth RCE Auth bypass	Critical10.0	—	26.2%	Jul 8, 2013
55Plan	CVE-2013-4784Proof of concept	The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands bhp · integrated lights-out bmc · CWE-287 pre-auth RCE Auth bypass	Critical10.0	—	49.5%	Jul 8, 2013
60This week	CVE-2013-4786Weaponized	The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtainoracle · fujitsu m10 firmware · CWE-255 Pre-auth	High7.5	—	78.5%	Jul 8, 2013
50Plan	CVE-2013-1362Weaponized	Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arnagios · remote plug in executor · CWE-20 pre-auth RCE	High7.5	—	65.7%	Jul 9, 2013
41Plan	CVE-2013-4787Proof of concept	Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to executgoogle · android · CWE-310 pre-auth RCE	Critical9.3	—	13.5%	Jul 9, 2013
40Plan	CVE-2013-1300Weaponized	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 Smicrosoft · windows 7 · CWE-264 Local privilege escalation	High7.2	—	12.1%	Jul 9, 2013
45Plan	CVE-2013-3115Proof of concept	Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.0%	Jul 9, 2013
44Plan	CVE-2013-3127No exploit	The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Formamicrosoft · windows media format runtime · CWE-94 pre-auth RCE	Critical9.3	—	21.9%	Jul 9, 2013
41Plan	CVE-2013-3129No exploit	Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+,microsoft · .net framework · CWE-94 RCE	High7.8	—	32.3%	Jul 9, 2013
44Plan	CVE-2013-3131No exploit	Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data inmicrosoft · .net framework · CWE-94 pre-auth RCE	Critical9.3	—	22.0%	Jul 9, 2013
44Plan	CVE-2013-3132No exploit	Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflemicrosoft · .net framework · CWE-94 pre-auth RCE	Critical9.3	—	21.7%	Jul 9, 2013
43Plan	CVE-2013-3133No exploit	Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allowmicrosoft · .net framework · CWE-94 pre-auth RCE	Critical9.3	—	20.6%	Jul 9, 2013
43Plan	CVE-2013-3134No exploit	The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocatemicrosoft · .net framework · CWE-94 pre-auth RCE	Critical9.3	—	21.0%	Jul 9, 2013
47Plan	CVE-2013-3143Proof of concept	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	32.7%	Jul 9, 2013
44Plan	CVE-2013-3144Proof of concept	Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	22.7%	Jul 9, 2013
45Plan	CVE-2013-3145Proof of concept	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
44Plan	CVE-2013-3146Proof of concept	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	23.5%	Jul 9, 2013
45Plan	CVE-2013-3147Proof of concept	Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
45Plan	CVE-2013-3148Proof of concept	Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
45Plan	CVE-2013-3149Proof of concept	Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
45Plan	CVE-2013-3150Proof of concept	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
44Plan	CVE-2013-3151Proof of concept	Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	22.7%	Jul 9, 2013
44Plan	CVE-2013-3152Proof of concept	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	23.5%	Jul 9, 2013
45Plan	CVE-2013-3153Proof of concept	Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
45Plan	CVE-2013-3161Proof of concept	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
45Plan	CVE-2013-3162Proof of concept	Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	25.0%	Jul 9, 2013
86Now	CVE-2013-3163Weaponized	Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-787 pre-auth RCE Memory safety	High8.8	KEV	70.6%	Jul 9, 2013
44Plan	CVE-2013-3164Proof of concept	Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	23.5%	Jul 9, 2013
22Monitor	CVE-2013-3166Proof of concept	Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script microsoft · internet explorer · CWE-79 Pre-auth XSS	Medium4.3	—	16.3%	Jul 9, 2013
43Plan	CVE-2013-3171No exploit	The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissionsmicrosoft · .net framework · CWE-94 pre-auth RCE	Critical9.3	—	20.6%	Jul 9, 2013
47Plan	CVE-2013-3174Proof of concept	DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SPmicrosoft · windows 7 · CWE-94 pre-auth RCE	Critical9.3	—	31.9%	Jul 9, 2013
47Plan	CVE-2013-3178No exploit	Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or cmicrosoft · silverlight · CWE-94 pre-auth RCE	Critical9.3	—	32.0%	Jul 9, 2013
40Plan	CVE-2013-1868Proof of concept	Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and exevideolan · vlc media player · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.9%	Jul 10, 2013
65This week	CVE-2013-1965Proof of concept	Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL codeapache · struts · CWE-94 pre-auth RCE	Critical9.3	—	93.5%	Jul 10, 2013
59Plan	CVE-2013-1966Weaponized	Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled whapache · struts · CWE-94 pre-auth RCE	Critical9.3	—	73.7%	Jul 10, 2013
60This week	CVE-2013-2115Weaponized	Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled whapache · struts · CWE-94 pre-auth RCE	High8.1	—	74.6%	Jul 10, 2013
26Monitor	CVE-2013-1896No exploit	mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackerapache · http server Pre-auth Denial of service	Medium4.3	—	29.4%	Jul 10, 2013
24Monitor	CVE-2013-2765Proof of concept	The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereferencapache · http server · CWE-476 Pre-auth Memory safety Denial of service	Medium5.0	—	13.7%	Jul 15, 2013
21Monitor	CVE-2013-4117Proof of concept	Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remwordpress · wordpress · CWE-79 Pre-auth XSS	Medium4.3	—	12.9%	Jul 16, 2013
58Plan	CVE-2013-2134Proof of concept	Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not apache · struts · CWE-94 pre-auth RCE	Critical9.3	—	70.2%	Jul 16, 2013
41Plan	CVE-2013-2135No exploit	Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains bothapache · struts · CWE-94 pre-auth RCE	Critical9.3	—	13.8%	Jul 16, 2013
40Plan	CVE-2013-3763Weaponized	Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated usoracle · fusion middleware	Medium5.5	—	59.8%	Jul 17, 2013
37Monitor	CVE-2013-1606Proof of concept	Buffer overflow in the ubnt-streamer RTSP service on the Ubiquiti UBNT AirCam with airVision firmware before 1.1.6 allows remote attackers tui · airvision firmware · CWE-119 pre-auth RCE Memory safety	High7.5	—	23.3%	Jul 18, 2013
40Plan	CVE-2013-4011Weaponized	Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to ibm · aix Local privilege escalation	High7.2	—	2.8%	Jul 18, 2013
39Monitor	CVE-2013-4878Proof of concept	The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAliparallels · parallels plesk panel · CWE-264 pre-auth RCE	High7.5	—	31.0%	Jul 18, 2013
56Plan	CVE-2013-2028Weaponized	The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of servif5 · nginx · CWE-787 pre-auth RCE Memory safety	High7.5	—	87.4%	Jul 19, 2013
27Monitor	CVE-2013-2070No exploit	http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servef5 · nginx Pre-auth	Medium5.8	—	11.9%	Jul 19, 2013
51Plan	CVE-2013-2248Proof of concept	Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sitesapache · struts · CWE-20 Pre-auth Open redirect	Medium5.8	—	94.6%	Jul 19, 2013
99Now	CVE-2013-2251Weaponized	Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,apache · archiva · CWE-74 pre-auth RCE	Critical9.8	KEV	99.9%	Jul 19, 2013
34Monitor	CVE-2013-2165Proof of concept	ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web redhat · jboss enterprise application platform · CWE-264 pre-auth RCE Deserialization	High7.5	—	12.6%	Jul 23, 2013
35Monitor	CVE-2013-4002Proof of concept	XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-Fibm · java Pre-auth Denial of service	High7.1	—	24.7%	Jul 23, 2013
34Monitor	CVE-2013-2249No exploit	mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without capache · http server Pre-auth	High7.5	—	14.2%	Jul 23, 2013
34Monitor	CVE-2013-3429Proof of concept	Multiple directory traversal vulnerabilities in Cisco Video Surveillance Manager (VSM) before 7.0.0 allow remote attackers to read system ficisco · video surveillance manager · CWE-22 Pre-auth Path traversal	High7.8	—	10.1%	Jul 25, 2013
49Plan	CVE-2013-2370Weaponized	Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1hp · loadrunner pre-auth RCE	High7.5	—	61.9%	Jul 29, 2013
60This week	CVE-2013-4798Weaponized	Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1hp · loadrunner pre-auth RCE	Critical10.0	—	66.9%	Jul 29, 2013
49Plan	CVE-2013-4800Weaponized	Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1hp · loadrunner pre-auth RCE	Critical9.3	—	39.3%	Jul 29, 2013
41Plan	CVE-2013-4854No exploit	The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco Bisc · bind Pre-auth Denial of service	High7.8	—	34.1%	Jul 29, 2013
61This week	CVE-2013-2367Weaponized	Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code vihp · sitescope pre-auth RCE	Critical10.0	—	68.8%	Jul 31, 2013
37Monitor	CVE-2013-2088Proof of concept	contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute aapache · subversion · CWE-20 RCE	High7.1	—	31.4%	Jul 31, 2013
40Plan	CVE-2013-2113Weaponized	The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to credhat · openstack · CWE-264	Medium6.0	—	20.9%	Jul 31, 2013
40Plan	CVE-2013-2121Weaponized	Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users redhat · openstack · CWE-94 RCE	Medium6.0	—	24.7%	Jul 31, 2013
40Plan	CVE-2013-3956Weaponized	The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista annovell · client · CWE-264 Local privilege escalation	High7.2	—	7.7%	Jul 31, 2013
59Plan	CVE-2013-5019Weaponized	Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP rvector · ultra mini httpd · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	63.5%	Jul 31, 2013

CVE-2013-2171
40Plan
The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not proper
MediumCVSS 6.9WeaponizedEPSS 6%
- Local privilege escalation
freebsd · freebsdJul 1, 2013
CVE-2013-2343
59Plan
Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitr
CriticalCVSS 10.0WeaponizedEPSS 61%
- pre-auth RCE
hp · lefthand p4000 virtual san applianceJul 2, 2013
CVE-2013-1960
41Plan
Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause
CriticalCVSS 9.3No exploitEPSS 11%
- pre-auth RCE
- Memory safety
remotesensing · libtiffJul 3, 2013
CVE-2013-3563
45Plan
Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (dae
HighCVSS 7.5WeaponizedEPSS 49%
- pre-auth RCE
- Memory safety
lianja · lianja sql serverJul 4, 2013
CVE-2013-2340
43Plan
Unspecified vulnerability on the HP ProCurve JC###A, JC###B, JD###A, JD###B, JE###A, JF###A, JF###B, JF###C, JG###A, 658250-B21, and 658247-
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
hp · 3com baseline plus switchJul 6, 2013
CVE-2013-0235
40Plan
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attack
MediumCVSS 6.4WeaponizedEPSS 29%
- Pre-auth
- SSRF
wordpress · wordpressJul 8, 2013
CVE-2013-4782
48Plan
The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite
CriticalCVSS 10.0WeaponizedEPSS 26%
- pre-auth RCE
- Auth bypass
supermicro · bmcJul 8, 2013
CVE-2013-4784
55Plan
The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands b
CriticalCVSS 10.0Proof of conceptEPSS 49%
- pre-auth RCE
- Auth bypass
hp · integrated lights-out bmcJul 8, 2013
CVE-2013-4786
60This week
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain
HighCVSS 7.5WeaponizedEPSS 78%
- Pre-auth
oracle · fujitsu m10 firmwareJul 8, 2013
CVE-2013-1362
50Plan
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute ar
HighCVSS 7.5WeaponizedEPSS 65%
- pre-auth RCE
nagios · remote plug in executorJul 9, 2013
CVE-2013-4787
41Plan
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execut
CriticalCVSS 9.3Proof of conceptEPSS 13%
- pre-auth RCE
google · androidJul 9, 2013
CVE-2013-1300
40Plan
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S
HighCVSS 7.2WeaponizedEPSS 12%
- Local privilege escalation
microsoft · windows 7Jul 9, 2013
CVE-2013-3115
45Plan
Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJul 9, 2013
CVE-2013-3127
44Plan
The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Forma
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
microsoft · windows media format runtimeJul 9, 2013
CVE-2013-3129
41Plan
Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+,
HighCVSS 7.8No exploitEPSS 32%
- RCE
microsoft · .net frameworkJul 9, 2013
CVE-2013-3131
44Plan
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · .net frameworkJul 9, 2013
CVE-2013-3132
44Plan
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use refle
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
microsoft · .net frameworkJul 9, 2013
CVE-2013-3133
43Plan
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allow
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
microsoft · .net frameworkJul 9, 2013
CVE-2013-3134
43Plan
The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocate
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
microsoft · .net frameworkJul 9, 2013
CVE-2013-3143
47Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3Proof of conceptEPSS 32%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3144
44Plan
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3Proof of conceptEPSS 22%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3145
45Plan
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3146
44Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3Proof of conceptEPSS 23%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3147
45Plan
Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3148
45Plan
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3149
45Plan
Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3150
45Plan
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3151
44Plan
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3Proof of conceptEPSS 22%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3152
44Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3Proof of conceptEPSS 23%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3153
45Plan
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3161
45Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3162
45Plan
Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3Proof of conceptEPSS 25%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3163
86Now
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 8.8KEVWeaponizedEPSS 70%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJul 9, 2013
CVE-2013-3164
44Plan
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3Proof of conceptEPSS 23%
- pre-auth RCE
microsoft · internet explorerJul 9, 2013
CVE-2013-3166
22Monitor
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script
MediumCVSS 4.3Proof of conceptEPSS 16%
- Pre-auth
- XSS
microsoft · internet explorerJul 9, 2013
CVE-2013-3171
43Plan
The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
microsoft · .net frameworkJul 9, 2013
CVE-2013-3174
47Plan
DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP
CriticalCVSS 9.3Proof of conceptEPSS 31%
- pre-auth RCE
microsoft · windows 7Jul 9, 2013
CVE-2013-3178
47Plan
Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or c
CriticalCVSS 9.3No exploitEPSS 32%
- pre-auth RCE
microsoft · silverlightJul 9, 2013
CVE-2013-1868
40Plan
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and exe
CriticalCVSS 9.3Proof of conceptEPSS 10%
- pre-auth RCE
- Memory safety
videolan · vlc media playerJul 10, 2013
CVE-2013-1965
65This week
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code
CriticalCVSS 9.3Proof of conceptEPSS 93%
- pre-auth RCE
apache · strutsJul 10, 2013
CVE-2013-1966
59Plan
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled wh
CriticalCVSS 9.3WeaponizedEPSS 73%
- pre-auth RCE
apache · strutsJul 10, 2013
CVE-2013-2115
60This week
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled wh
HighCVSS 8.1WeaponizedEPSS 74%
- pre-auth RCE
apache · strutsJul 10, 2013
CVE-2013-1896
26Monitor
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attacker
MediumCVSS 4.3No exploitEPSS 29%
- Pre-auth
- Denial of service
apache · http serverJul 10, 2013
CVE-2013-2765
24Monitor
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereferenc
MediumCVSS 5.0Proof of conceptEPSS 13%
- Pre-auth
- Memory safety
- Denial of service
apache · http serverJul 15, 2013
CVE-2013-4117
21Monitor
Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows rem
MediumCVSS 4.3Proof of conceptEPSS 12%
- Pre-auth
- XSS
wordpress · wordpressJul 16, 2013
CVE-2013-2134
58Plan
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not
CriticalCVSS 9.3Proof of conceptEPSS 70%
- pre-auth RCE
apache · strutsJul 16, 2013
CVE-2013-2135
41Plan
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
apache · strutsJul 16, 2013
CVE-2013-3763
40Plan
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated us
MediumCVSS 5.5WeaponizedEPSS 59%
oracle · fusion middlewareJul 17, 2013
CVE-2013-1606
37Monitor
Buffer overflow in the ubnt-streamer RTSP service on the Ubiquiti UBNT AirCam with airVision firmware before 1.1.6 allows remote attackers t
HighCVSS 7.5Proof of conceptEPSS 23%
- pre-auth RCE
- Memory safety
ui · airvision firmwareJul 18, 2013
CVE-2013-4011
40Plan
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to
HighCVSS 7.2WeaponizedEPSS 2%
- Local privilege escalation
ibm · aixJul 18, 2013
CVE-2013-4878
39Monitor
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAli
HighCVSS 7.5Proof of conceptEPSS 31%
- pre-auth RCE
parallels · parallels plesk panelJul 18, 2013
CVE-2013-2028
56Plan
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of servi
HighCVSS 7.5WeaponizedEPSS 87%
- pre-auth RCE
- Memory safety
f5 · nginxJul 19, 2013
CVE-2013-2070
27Monitor
http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP serve
MediumCVSS 5.8No exploitEPSS 11%
- Pre-auth
f5 · nginxJul 19, 2013
CVE-2013-2248
51Plan
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites
MediumCVSS 5.8Proof of conceptEPSS 94%
- Pre-auth
- Open redirect
apache · strutsJul 19, 2013
CVE-2013-2251
99Now
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
apache · archivaJul 19, 2013
CVE-2013-2165
34Monitor
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web
HighCVSS 7.5Proof of conceptEPSS 12%
- pre-auth RCE
- Deserialization
redhat · jboss enterprise application platformJul 23, 2013
CVE-2013-4002
35Monitor
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-F
HighCVSS 7.1Proof of conceptEPSS 24%
- Pre-auth
- Denial of service
ibm · javaJul 23, 2013
CVE-2013-2249
34Monitor
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without c
HighCVSS 7.5No exploitEPSS 14%
- Pre-auth
apache · http serverJul 23, 2013
CVE-2013-3429
34Monitor
Multiple directory traversal vulnerabilities in Cisco Video Surveillance Manager (VSM) before 7.0.0 allow remote attackers to read system fi
HighCVSS 7.8Proof of conceptEPSS 10%
- Pre-auth
- Path traversal
cisco · video surveillance managerJul 25, 2013
CVE-2013-2370
49Plan
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1
HighCVSS 7.5WeaponizedEPSS 61%
- pre-auth RCE
hp · loadrunnerJul 29, 2013
CVE-2013-4798
60This week
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1
CriticalCVSS 10.0WeaponizedEPSS 66%
- pre-auth RCE
hp · loadrunnerJul 29, 2013
CVE-2013-4800
49Plan
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1
CriticalCVSS 9.3WeaponizedEPSS 39%
- pre-auth RCE
hp · loadrunnerJul 29, 2013
CVE-2013-4854
41Plan
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco B
HighCVSS 7.8No exploitEPSS 34%
- Pre-auth
- Denial of service
isc · bindJul 29, 2013
CVE-2013-2367
61This week
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code vi
CriticalCVSS 10.0WeaponizedEPSS 68%
- pre-auth RCE
hp · sitescopeJul 31, 2013
CVE-2013-2088
37Monitor
contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute a
HighCVSS 7.1Proof of conceptEPSS 31%
- RCE
apache · subversionJul 31, 2013
CVE-2013-2113
40Plan
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to c
MediumCVSS 6.0WeaponizedEPSS 20%
redhat · openstackJul 31, 2013
CVE-2013-2121
40Plan
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users
MediumCVSS 6.0WeaponizedEPSS 24%
- RCE
redhat · openstackJul 31, 2013
CVE-2013-3956
40Plan
The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista an
HighCVSS 7.2WeaponizedEPSS 7%
- Local privilege escalation
novell · clientJul 31, 2013
CVE-2013-5019
59Plan
Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP r
CriticalCVSS 10.0WeaponizedEPSS 63%
- pre-auth RCE
- Memory safety
vector · ultra mini httpdJul 31, 2013