Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2013

52 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-5627
    19Monitor

    Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executio

    MediumCVSS 4.0Proof of conceptEPSS 11%

    oracle · mysqlOct 1, 2013

  • CVE-2013-3690
    31Monitor

    Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040

    MediumCVSS 6.8Proof of conceptEPSS 12%

    brickcom · 100ap device firmwareOct 1, 2013

  • CVE-2013-1892
    40Plan

    MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows r

    MediumCVSS 6.0WeaponizedEPSS 44%

    mongodb · mongodbOct 1, 2013

  • CVE-2013-3969
    29Monitor

    The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (u

    MediumCVSS 6.5Proof of conceptEPSS 10%

    mongodb · mongodbOct 1, 2013

  • CVE-2013-5979
    25Monitor

    Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary

    MediumCVSS 5.0Proof of conceptEPSS 18%

    xibosignage · xiboOct 2, 2013

  • CVE-2013-3248
    43Plan

    Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in t

    CriticalCVSS 9.3WeaponizedEPSS 18%

    corel · pdf fusionOct 3, 2013

  • CVE-2013-4788
    23Monitor

    The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initial

    MediumCVSS 5.1Proof of conceptEPSS 11%

    gnu · glibcOct 4, 2013

  • CVE-2013-3128
    52Plan

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,

    CriticalCVSS 9.3No exploitEPSS 50%

    microsoft · windows 7Oct 9, 2013

  • CVE-2013-3195
    52Plan

    The DSA_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2, Windows Server 2003 SP2, Wind

    CriticalCVSS 10.0No exploitEPSS 38%

    microsoft · windows 7Oct 9, 2013

  • CVE-2013-3860
    40Plan

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, whi

    HighCVSS 7.8No exploitEPSS 30%

    microsoft · .net frameworkOct 9, 2013

  • CVE-2013-3861
    56Plan

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or

    HighCVSS 7.8No exploitEPSS 82%

    microsoft · .net frameworkOct 9, 2013

  • CVE-2013-3871
    43Plan

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3872
    43Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3873
    43Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3874
    43Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3875
    43Plan

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3880
    18Monitor

    The App Container feature in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to

    LowCVSS 3.5No exploitEPSS 12%

    microsoft · windows 8Oct 9, 2013

  • CVE-2013-3881
    40Plan

    win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a

    HighCVSS 7.2WeaponizedEPSS 14%

    microsoft · windows 7Oct 9, 2013

  • CVE-2013-3882
    43Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3885
    43Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3886
    43Plan

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-3889
    45Plan

    Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Ex

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · excelOct 9, 2013

  • CVE-2013-3890
    43Plan

    Microsoft Excel 2007 SP3, Excel Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Off

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · excelOct 9, 2013

  • CVE-2013-3891
    43Plan

    Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerabilit

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · wordOct 9, 2013

  • CVE-2013-3892
    43Plan

    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, ak

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · office compatibility packOct 9, 2013

  • CVE-2013-3894
    45Plan

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,

    HighCVSS 8.1No exploitEPSS 43%

    microsoft · windows 7Oct 9, 2013

  • CVE-2013-3895
    36Monitor

    Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, ak

    MediumCVSS 6.8No exploitEPSS 29%

    microsoft · office web appsOct 9, 2013

  • CVE-2013-3896
    72This week

    Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote at

    MediumCVSS 5.5KEVWeaponizedEPSS 67%

    microsoft · silverlightOct 9, 2013

  • CVE-2013-3897
    88Now

    Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers

    HighCVSS 8.8KEVWeaponizedEPSS 77%

    microsoft · internet explorerOct 9, 2013

  • CVE-2013-5576
    41Plan

    administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote

    MediumCVSS 6.8WeaponizedEPSS 48%

    joomla · joomla\!Oct 9, 2013

  • CVE-2013-5967
    40Plan

    Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attack

    HighCVSS 7.5WeaponizedEPSS 19%

    alienvault · open source security information managementOct 9, 2013

  • CVE-2012-4412
    35Monitor

    Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to caus

    HighCVSS 7.5Proof of conceptEPSS 17%

    gnu · glibcOct 9, 2013

  • CVE-2013-5528
    23Monitor

    Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authentic

    MediumCVSS 4.0Proof of conceptEPSS 23%

    cisco · unified communications managerOct 10, 2013

  • CVE-2013-2578
    62This week

    cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware L

    CriticalCVSS 10.0WeaponizedEPSS 73%

    tp-link · tl-sc3130Oct 11, 2013

  • CVE-2013-3686
    48Plan

    cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password vi

    CriticalCVSS 10.0Proof of conceptEPSS 27%

    ovislink · airlive wl2600camOct 11, 2013

  • CVE-2013-4822
    59Plan

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIM

    CriticalCVSS 10.0WeaponizedEPSS 62%

    hp · imc branch intelligent management system software moduleOct 13, 2013

  • CVE-2013-4823
    40Plan

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIM

    MediumCVSS 5.0WeaponizedEPSS 37%

    hp · intelligent management centerOct 13, 2013

  • CVE-2013-4824
    40Plan

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote at

    HighCVSS 7.5WeaponizedEPSS 23%

    hp · imc service operation management software moduleOct 13, 2013

  • CVE-2013-4826
    40Plan

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote at

    MediumCVSS 5.0WeaponizedEPSS 31%

    hp · imc service operation management software moduleOct 13, 2013

  • CVE-2013-3827
    30Monitor

    Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDevelope

    MediumCVSS 5.0Proof of conceptEPSS 32%

    oracle · fusion middlewareOct 16, 2013

  • CVE-2013-5842
    45Plan

    Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u4

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    oracle · jdkOct 16, 2013

  • CVE-2013-4365
    34Monitor

    Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HT

    HighCVSS 7.5No exploitEPSS 13%

    apache · mod fcgidOct 17, 2013

  • CVE-2013-6021
    41Plan

    Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    watchguard · firewareOct 19, 2013

  • CVE-2013-6129
    46Plan

    The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata

    HighCVSS 7.5WeaponizedEPSS 51%

    vbulletin · vbulletinOct 19, 2013

  • CVE-2013-4450
    40Plan

    The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CP

    MediumCVSS 5.0WeaponizedEPSS 37%

    nodejs · nodejsOct 21, 2013

  • CVE-2013-4295
    24Monitor

    The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing a

    MediumCVSS 5.0Proof of conceptEPSS 11%

    apache · shindigOct 23, 2013

  • CVE-2013-5135
    33Monitor

    Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple Remote Desktop before 3.5.4 allows remote attac

    HighCVSS 7.5No exploitEPSS 10%

    apple · apple remote desktopOct 23, 2013

  • CVE-2013-6127
    27Monitor

    The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly re

    MediumCVSS 5.8Proof of conceptEPSS 13%

    wellintech · kingviewOct 25, 2013

  • CVE-2011-4106
    34Monitor

    TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload a

    MediumCVSS 6.8Proof of conceptEPSS 23%

    binarymoon · timthumbOct 26, 2013

  • CVE-2013-2186
    34Monitor

    The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red H

    HighCVSS 7.5Proof of conceptEPSS 12%

    redhat · jboss enterprise brms platformOct 28, 2013

  • CVE-2012-6303
    30Monitor

    Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4,

    MediumCVSS 6.8Proof of conceptEPSS 10%

    kth · snack sound toolkitOct 28, 2013

  • CVE-2013-3630
    40Plan

    Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then tr

    MediumCVSS 4.6WeaponizedEPSS 41%

    moodle · moodleOct 31, 2013