Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2013

38 records · 5 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2013-3617
    40Plan

    The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an ext

    LowCVSS 3.5WeaponizedEPSS 21%

    openbravo · openbravo erpNov 2, 2013

  • CVE-2013-3631
    40Plan

    NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advance

    MediumCVSS 6.0WeaponizedEPSS 13%

    nas4free · nas4freeNov 2, 2013

  • CVE-2013-6023
    34Monitor

    Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbi

    HighCVSS 7.8Proof of conceptEPSS 10%

    tvt · dvrNov 2, 2013

  • CVE-2013-4835
    51Plan

    The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute a

    HighCVSS 7.5WeaponizedEPSS 71%

    hp · sitescopeNov 4, 2013

  • CVE-2013-4837
    59Plan

    Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unkn

    CriticalCVSS 10.0WeaponizedEPSS 62%

    hp · loadrunnerNov 4, 2013

  • CVE-2013-4838
    43Plan

    Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unkn

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · loadrunnerNov 4, 2013

  • CVE-2013-6618
    39Monitor

    jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.

    CriticalCVSS 9.0Proof of conceptEPSS 10%

    juniper · junosNov 5, 2013

  • CVE-2013-3906
    86Now

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and

    HighCVSS 7.8KEVWeaponizedEPSS 84%

    microsoft · excel viewerNov 6, 2013

  • CVE-2013-3986
    40Plan

    IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted

    MediumCVSS 4.3WeaponizedEPSS 9%

    ibm · lotus sametimeNov 8, 2013

  • CVE-2013-3918
    87Now

    The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V

    HighCVSS 8.8KEVWeaponizedEPSS 73%

    microsoft · windows 7Nov 12, 2013

  • CVE-2013-0082
    43Plan

    Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · officeNov 12, 2013

  • CVE-2013-1324
    46Plan

    Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute a

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · officeNov 12, 2013

  • CVE-2013-1325
    46Plan

    Heap-based buffer overflow in Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPer

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · officeNov 12, 2013

  • CVE-2013-3869
    25Monitor

    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · windows 7Nov 12, 2013

  • CVE-2013-3905
    23Monitor

    Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which al

    MediumCVSS 5.0No exploitEPSS 11%

    microsoft · outlookNov 12, 2013

  • CVE-2013-3908
    27Monitor

    Microsoft Internet Explorer 6 through 10 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive informa

    MediumCVSS 4.3No exploitEPSS 33%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3909
    22Monitor

    Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characte

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3910
    43Plan

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3911
    43Plan

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3912
    43Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3914
    43Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3915
    43Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3916
    42Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3917
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · internet explorerNov 12, 2013

  • CVE-2013-3940
    47Plan

    Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Win

    CriticalCVSS 9.3No exploitEPSS 34%

    microsoft · windows 7Nov 12, 2013

  • CVE-2013-5330
    43Plan

    Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, A

    CriticalCVSS 10.0No exploitEPSS 11%

    adobe · flash playerNov 12, 2013

  • CVE-2013-4557
    40Plan

    The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers

    HighCVSS 7.5WeaponizedEPSS 25%

    spip · spipNov 17, 2013

  • CVE-2013-6801
    32Monitor

    Microsoft Word 2003 SP2 and SP3 on Windows XP SP3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed .do

    HighCVSS 7.1No exploitEPSS 14%

    microsoft · wordNov 18, 2013

  • CVE-2013-5223
    66This week

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev.

    MediumCVSS 5.4KEVWeaponizedEPSS 50%

    dlink · dsl-2760u firmwareNov 19, 2013

  • CVE-2013-4579
    20Monitor

    The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking

    MediumCVSS 4.3Proof of conceptEPSS 10%

    linux · linux kernelNov 20, 2013

  • CVE-2013-6282
    77This week

    The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain add

    HighCVSS 8.8KEVWeaponizedEPSS 39%

    linux · linux kernelNov 20, 2013

  • CVE-2013-4559
    33Monitor

    lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd

    HighCVSS 7.6No exploitEPSS 10%

    lighttpd · lighttpdNov 20, 2013

  • CVE-2013-6829
    54Plan

    admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pingh

    HighCVSS 7.5WeaponizedEPSS 79%

    pineapp · mail-secureNov 20, 2013

  • CVE-2013-4474
    23Monitor

    Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a

    MediumCVSS 5.0Proof of conceptEPSS 10%

    canonical · ubuntu linuxNov 23, 2013

  • CVE-2013-4547
    50Plan

    nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character i

    HighCVSS 7.5Proof of conceptEPSS 67%

    f5 · nginxNov 23, 2013

  • CVE-2013-4164
    40Plan

    Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 4

    MediumCVSS 6.8WeaponizedEPSS 34%

    ruby-lang · rubyNov 23, 2013

  • CVE-2013-5065
    71This week

    NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted applic

    HighCVSS 7.8KEVWeaponizedEPSS 34%

    microsoft · windows 2003 serverNov 27, 2013

  • CVE-2013-5912
    49Plan

    VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via

    CriticalCVSS 10.0Proof of conceptEPSS 30%

    thomsonreuters · velocity analytics vhayu analytic serverNov 28, 2013