By publication date

Exploited and new serious CVEs: September 2013

57 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
23Monitor	CVE-2013-5642No exploit	The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Cerdigium · asterisk · CWE-20 Pre-auth Denial of service	Medium5.0	—	11.6%	Sep 9, 2013
67This week	CVE-2013-4983Weaponized	The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers tosophos · web appliance firmware · CWE-78 pre-auth RCE Command injection	Critical10.0	—	90.1%	Sep 10, 2013
40Plan	CVE-2013-4984Weaponized	The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local usersophos · web appliance · CWE-78 RCE Local privilege escalation Command injection	High7.2	—	8.1%	Sep 10, 2013
43Plan	CVE-2013-0081No exploit	Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned womicrosoft · sharepoint foundation · CWE-20 Pre-auth Denial of service	Medium5.0	—	76.1%	Sep 11, 2013
60This week	CVE-2013-0810Weaponized	Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute microsoft · windows server 2003 · CWE-94 pre-auth RCE	High8.1	—	59.8%	Sep 11, 2013
46Plan	CVE-2013-1315No exploit	Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, anmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	28.8%	Sep 11, 2013
49Plan	CVE-2013-1330No exploit	The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apmicrosoft · sharepoint foundation · CWE-20 pre-auth RCE	Critical10.0	—	30.2%	Sep 11, 2013
26Monitor	CVE-2013-3137No exploit	Microsoft FrontPage 2003 SP3 does not properly parse DTDs, which allows remote attackers to obtain sensitive information via crafted XML datmicrosoft · frontpage · CWE-200 Pre-auth Info leak	Medium4.3	—	29.1%	Sep 11, 2013
43Plan	CVE-2013-3155No exploit	Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a deniamicrosoft · access · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.1%	Sep 11, 2013
43Plan	CVE-2013-3156No exploit	Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a deniamicrosoft · access · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.0%	Sep 11, 2013
43Plan	CVE-2013-3157No exploit	Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a deniamicrosoft · access · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.6%	Sep 11, 2013
43Plan	CVE-2013-3158No exploit	Microsoft Excel 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.7%	Sep 11, 2013
22Monitor	CVE-2013-3159No exploit	Microsoft Excel 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Excel Viewer; and Microsoft Office Compatibility Pack SP3 allow remote attackers tmicrosoft · excel · CWE-20 Pre-auth XXE	Medium4.3	—	15.4%	Sep 11, 2013
27Monitor	CVE-2013-3160No exploit	Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XMmicrosoft · office · CWE-200 Pre-auth XXE Info leak	Medium5.0	—	22.6%	Sep 11, 2013
24Monitor	CVE-2013-3179Proof of concept	Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to injemicrosoft · sharepoint foundation · CWE-79 Pre-auth XSS	Medium4.3	—	22.2%	Sep 11, 2013
37Monitor	CVE-2013-3180No exploit	Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrarmicrosoft · sharepoint foundation · CWE-79 Pre-auth XSS	Medium4.3	—	65.5%	Sep 11, 2013
43Plan	CVE-2013-3201No exploit	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.1%	Sep 11, 2013
43Plan	CVE-2013-3202No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.1%	Sep 11, 2013
44Plan	CVE-2013-3203No exploit	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	23.9%	Sep 11, 2013
43Plan	CVE-2013-3204No exploit	Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.1%	Sep 11, 2013
57Plan	CVE-2013-3205Weaponized	Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	66.2%	Sep 11, 2013
43Plan	CVE-2013-3206No exploit	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.3%	Sep 11, 2013
43Plan	CVE-2013-3207No exploit	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.3%	Sep 11, 2013
43Plan	CVE-2013-3208No exploit	Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.3%	Sep 11, 2013
43Plan	CVE-2013-3209No exploit	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.1%	Sep 11, 2013
43Plan	CVE-2013-3845No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.3%	Sep 11, 2013
43Plan	CVE-2013-3847No exploit	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SPmicrosoft · sharepoint foundation · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.9%	Sep 11, 2013
43Plan	CVE-2013-3848No exploit	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SPmicrosoft · office web apps · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	21.1%	Sep 11, 2013
43Plan	CVE-2013-3849No exploit	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SPmicrosoft · office compatibility pack · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	21.0%	Sep 11, 2013
43Plan	CVE-2013-3850No exploit	Microsoft Word 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Word Viewer allow remote attackers to execute armicrosoft · office compatibility pack · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.0%	Sep 11, 2013
43Plan	CVE-2013-3851No exploit	Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers tomicrosoft · office compatibility pack · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.1%	Sep 11, 2013
43Plan	CVE-2013-3852No exploit	Microsoft Word 2003 SP3, 2007 SP3, and 2010 SP1; Office Compatibility Pack SP3; and Word Viewer allow remote attackers to execute arbitrary microsoft · office compatibility pack · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.0%	Sep 11, 2013
43Plan	CVE-2013-3853No exploit	Microsoft Office 2007 SP3 and Word 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruptionmicrosoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.1%	Sep 11, 2013
43Plan	CVE-2013-3854No exploit	Microsoft Office 2007 SP3 and Word 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruptionmicrosoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.1%	Sep 11, 2013
43Plan	CVE-2013-3855No exploit	Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or caumicrosoft · office compatibility pack · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.1%	Sep 11, 2013
43Plan	CVE-2013-3856No exploit	Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vimicrosoft · word · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.1%	Sep 11, 2013
43Plan	CVE-2013-3857No exploit	Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 Smicrosoft · sharepoint server · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	21.0%	Sep 11, 2013
43Plan	CVE-2013-3858No exploit	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SPmicrosoft · office compatibility pack · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	21.0%	Sep 11, 2013
43Plan	CVE-2013-3863No exploit	Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to execute arbitrary code via a crafted OLE object in a file, akmicrosoft · windows xp · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	21.5%	Sep 11, 2013
31Monitor	CVE-2013-3868No exploit	Microsoft Active Directory Lightweight Directory Service (AD LDS) on Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, amicrosoft · active directory lightweight directory service · CWE-20 Pre-auth	Medium5.0	—	36.2%	Sep 11, 2013
43Plan	CVE-2013-3870No exploit	Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including microsoft · outlook · CWE-399 pre-auth RCE	Critical9.3	—	18.6%	Sep 11, 2013
45Plan	CVE-2013-3351No exploit	Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allow attackadobe · acrobat reader · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	16.8%	Sep 12, 2013
44Plan	CVE-2013-3357No exploit	Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitadobe · acrobat · CWE-189 pre-auth RCE	Critical10.0	—	12.8%	Sep 12, 2013
44Plan	CVE-2013-3358No exploit	Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitadobe · acrobat · CWE-189 pre-auth RCE	Critical10.0	—	12.8%	Sep 12, 2013
93Now	CVE-2013-4810Weaponized	HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remhp · application lifecycle management · CWE-94 pre-auth RCE	Critical9.8	KEV	79.4%	Sep 16, 2013
61This week	CVE-2013-4811Weaponized	UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Drihp · identity driven manager · CWE-20 pre-auth RCE	Critical10.0	—	71.2%	Sep 16, 2013
56Plan	CVE-2013-4812Weaponized	UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven hp · identity driven manager · CWE-20 pre-auth RCE	Critical10.0	—	51.9%	Sep 16, 2013
40Plan	CVE-2013-4341Weaponized	Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2moodle · moodle · CWE-79 Pre-auth XSS	Medium4.3	—	21.8%	Sep 16, 2013
44Plan	CVE-2013-4123Proof of concept	client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a craftesquid-cache · squid · CWE-20 Pre-auth Denial of service	Medium5.0	—	80.4%	Sep 16, 2013
43Plan	CVE-2013-3612Proof of concept	Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier fordahuasecurity · dvr0404hd-a · CWE-255 Pre-auth Hard-coded credentials	Critical10.0	—	10.2%	Sep 17, 2013
91Now	CVE-2013-3893Weaponized	Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote amicrosoft · internet explorer · CWE-416 pre-auth RCE Memory safety	High8.8	KEV	87.5%	Sep 18, 2013
40Plan	CVE-2013-5696Weaponized	inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, whiglpi-project · glpi · CWE-352 pre-auth RCE SQL injection CSRF	Medium6.8	—	7.8%	Sep 22, 2013
63This week	CVE-2013-5486Weaponized	Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1)cisco · prime data center network manager · CWE-78 pre-auth RCE Path traversal Command injection	Critical10.0	—	75.9%	Sep 23, 2013
40Plan	CVE-2013-5093Weaponized	The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, whigraphite project · graphite · CWE-94 pre-auth RCE	Medium6.8	—	38.6%	Sep 27, 2013
55Plan	CVE-2013-2068Weaponized	Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to crredhat · cloudforms management engine · CWE-22 Pre-auth Path traversal	Critical9.4	—	58.6%	Sep 28, 2013
24Monitor	CVE-2013-5962Proof of concept	Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPresenvato · complete gallery manager plugin pre-auth RCE File upload	Medium5.1	—	14.7%	Sep 30, 2013
36Monitor	CVE-2013-1839No exploit	The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a densquid-cache · squid · CWE-20 Pre-auth Denial of service	High7.8	—	18.3%	Sep 30, 2013

CVE-2013-5642
23Monitor
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Cer
MediumCVSS 5.0No exploitEPSS 11%
- Pre-auth
- Denial of service
digium · asteriskSep 9, 2013
CVE-2013-4983
67This week
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to
CriticalCVSS 10.0WeaponizedEPSS 90%
- pre-auth RCE
- Command injection
sophos · web appliance firmwareSep 10, 2013
CVE-2013-4984
40Plan
The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local user
HighCVSS 7.2WeaponizedEPSS 8%
- RCE
- Local privilege escalation
- Command injection
sophos · web applianceSep 10, 2013
CVE-2013-0081
43Plan
Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned wo
MediumCVSS 5.0No exploitEPSS 76%
- Pre-auth
- Denial of service
microsoft · sharepoint foundationSep 11, 2013
CVE-2013-0810
60This week
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute
HighCVSS 8.1WeaponizedEPSS 59%
- pre-auth RCE
microsoft · windows server 2003Sep 11, 2013
CVE-2013-1315
46Plan
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, an
CriticalCVSS 9.3No exploitEPSS 28%
- pre-auth RCE
- Memory safety
microsoft · excelSep 11, 2013
CVE-2013-1330
49Plan
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Ap
CriticalCVSS 10.0No exploitEPSS 30%
- pre-auth RCE
microsoft · sharepoint foundationSep 11, 2013
CVE-2013-3137
26Monitor
Microsoft FrontPage 2003 SP3 does not properly parse DTDs, which allows remote attackers to obtain sensitive information via crafted XML dat
MediumCVSS 4.3No exploitEPSS 29%
- Pre-auth
- Info leak
microsoft · frontpageSep 11, 2013
CVE-2013-3155
43Plan
Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denia
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · accessSep 11, 2013
CVE-2013-3156
43Plan
Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denia
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · accessSep 11, 2013
CVE-2013-3157
43Plan
Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denia
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · accessSep 11, 2013
CVE-2013-3158
43Plan
Microsoft Excel 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · excelSep 11, 2013
CVE-2013-3159
22Monitor
Microsoft Excel 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Excel Viewer; and Microsoft Office Compatibility Pack SP3 allow remote attackers t
MediumCVSS 4.3No exploitEPSS 15%
- Pre-auth
- XXE
microsoft · excelSep 11, 2013
CVE-2013-3160
27Monitor
Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XM
MediumCVSS 5.0No exploitEPSS 22%
- Pre-auth
- XXE
- Info leak
microsoft · officeSep 11, 2013
CVE-2013-3179
24Monitor
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inje
MediumCVSS 4.3Proof of conceptEPSS 22%
- Pre-auth
- XSS
microsoft · sharepoint foundationSep 11, 2013
CVE-2013-3180
37Monitor
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrar
MediumCVSS 4.3No exploitEPSS 65%
- Pre-auth
- XSS
microsoft · sharepoint foundationSep 11, 2013
CVE-2013-3201
43Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3202
43Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3203
44Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3204
43Plan
Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3205
57Plan
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v
CriticalCVSS 9.3WeaponizedEPSS 66%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3206
43Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3207
43Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3208
43Plan
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3209
43Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3845
43Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 11, 2013
CVE-2013-3847
43Plan
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · sharepoint foundationSep 11, 2013
CVE-2013-3848
43Plan
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · office web appsSep 11, 2013
CVE-2013-3849
43Plan
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · office compatibility packSep 11, 2013
CVE-2013-3850
43Plan
Microsoft Word 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Word Viewer allow remote attackers to execute ar
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · office compatibility packSep 11, 2013
CVE-2013-3851
43Plan
Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · office compatibility packSep 11, 2013
CVE-2013-3852
43Plan
Microsoft Word 2003 SP3, 2007 SP3, and 2010 SP1; Office Compatibility Pack SP3; and Word Viewer allow remote attackers to execute arbitrary
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · office compatibility packSep 11, 2013
CVE-2013-3853
43Plan
Microsoft Office 2007 SP3 and Word 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · officeSep 11, 2013
CVE-2013-3854
43Plan
Microsoft Office 2007 SP3 and Word 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · officeSep 11, 2013
CVE-2013-3855
43Plan
Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cau
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · office compatibility packSep 11, 2013
CVE-2013-3856
43Plan
Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · wordSep 11, 2013
CVE-2013-3857
43Plan
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 S
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · sharepoint serverSep 11, 2013
CVE-2013-3858
43Plan
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · office compatibility packSep 11, 2013
CVE-2013-3863
43Plan
Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to execute arbitrary code via a crafted OLE object in a file, ak
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · windows xpSep 11, 2013
CVE-2013-3868
31Monitor
Microsoft Active Directory Lightweight Directory Service (AD LDS) on Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, a
MediumCVSS 5.0No exploitEPSS 36%
- Pre-auth
microsoft · active directory lightweight directory serviceSep 11, 2013
CVE-2013-3870
43Plan
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
microsoft · outlookSep 11, 2013
CVE-2013-3351
45Plan
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allow attack
CriticalCVSS 10.0No exploitEPSS 16%
- pre-auth RCE
- Memory safety
adobe · acrobat readerSep 12, 2013
CVE-2013-3357
44Plan
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbit
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
adobe · acrobatSep 12, 2013
CVE-2013-3358
44Plan
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbit
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
adobe · acrobatSep 12, 2013
CVE-2013-4810
93Now
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow rem
CriticalCVSS 9.8KEVWeaponizedEPSS 79%
- pre-auth RCE
hp · application lifecycle managementSep 16, 2013
CVE-2013-4811
61This week
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Dri
CriticalCVSS 10.0WeaponizedEPSS 71%
- pre-auth RCE
hp · identity driven managerSep 16, 2013
CVE-2013-4812
56Plan
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven
CriticalCVSS 10.0WeaponizedEPSS 51%
- pre-auth RCE
hp · identity driven managerSep 16, 2013
CVE-2013-4341
40Plan
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2
MediumCVSS 4.3WeaponizedEPSS 21%
- Pre-auth
- XSS
moodle · moodleSep 16, 2013
CVE-2013-4123
44Plan
client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafte
MediumCVSS 5.0Proof of conceptEPSS 80%
- Pre-auth
- Denial of service
squid-cache · squidSep 16, 2013
CVE-2013-3612
43Plan
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for
CriticalCVSS 10.0Proof of conceptEPSS 10%
- Pre-auth
- Hard-coded credentials
dahuasecurity · dvr0404hd-aSep 17, 2013
CVE-2013-3893
91Now
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote a
HighCVSS 8.8KEVWeaponizedEPSS 87%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 18, 2013
CVE-2013-5696
40Plan
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, whi
MediumCVSS 6.8WeaponizedEPSS 7%
- pre-auth RCE
- SQL injection
- CSRF
glpi-project · glpiSep 22, 2013
CVE-2013-5486
63This week
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1)
CriticalCVSS 10.0WeaponizedEPSS 75%
- pre-auth RCE
- Path traversal
- Command injection
cisco · prime data center network managerSep 23, 2013
CVE-2013-5093
40Plan
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, whi
MediumCVSS 6.8WeaponizedEPSS 38%
- pre-auth RCE
graphite project · graphiteSep 27, 2013
CVE-2013-2068
55Plan
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to cr
CriticalCVSS 9.4WeaponizedEPSS 58%
- Pre-auth
- Path traversal
redhat · cloudforms management engineSep 28, 2013
CVE-2013-5962
24Monitor
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPres
MediumCVSS 5.1Proof of conceptEPSS 14%
- pre-auth RCE
- File upload
envato · complete gallery manager pluginSep 30, 2013
CVE-2013-1839
36Monitor
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a den
HighCVSS 7.8No exploitEPSS 18%
- Pre-auth
- Denial of service
squid-cache · squidSep 30, 2013