Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2013

43 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2013-6935
    47Plan

    Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the S

    CriticalCVSS 9.3WeaponizedEPSS 32%

    videocharge · watermark masterDec 4, 2013

  • CVE-2013-6414
    40Plan

    actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers

    MediumCVSS 5.0WeaponizedEPSS 20%

    rubyonrails · railsDec 6, 2013

  • CVE-2013-4212
    51Plan

    Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expre

    MediumCVSS 6.8WeaponizedEPSS 81%

    apache · rollerDec 7, 2013

  • CVE-2013-6397
    34Monitor

    Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a ..

    MediumCVSS 4.3No exploitEPSS 56%

    apache · solrDec 7, 2013

  • CVE-2013-6407
    28Monitor

    The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an

    MediumCVSS 6.4No exploitEPSS 11%

    apache · solrDec 7, 2013

  • CVE-2013-6408
    28Monitor

    The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers

    MediumCVSS 6.4No exploitEPSS 11%

    apache · solrDec 7, 2013

  • CVE-2012-6612
    33Monitor

    The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified i

    HighCVSS 7.5No exploitEPSS 10%

    apache · solrDec 7, 2013

  • CVE-2013-1349
    40Plan

    Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname pa

    HighCVSS 7.5WeaponizedEPSS 22%

    os4ed · opensisDec 9, 2013

  • CVE-2013-5447
    40Plan

    Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code

    MediumCVSS 6.8WeaponizedEPSS 34%

    ibm · forms viewerDec 10, 2013

  • CVE-2013-3623
    62This week

    Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) w

    CriticalCVSS 10.0WeaponizedEPSS 72%

    supermicro · intelligent platform management firmwareDec 10, 2013

  • CVE-2013-5042
    21Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foun

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · asp.net signalrDec 10, 2013

  • CVE-2013-5045
    40Plan

    Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges

    MediumCVSS 6.2WeaponizedEPSS 17%

    microsoft · internet explorerDec 10, 2013

  • CVE-2013-5047
    41Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerDec 10, 2013

  • CVE-2013-5048
    41Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerDec 10, 2013

  • CVE-2013-5049
    43Plan

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerDec 10, 2013

  • CVE-2013-5051
    41Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerDec 10, 2013

  • CVE-2013-5052
    41Plan

    Microsoft Internet Explorer 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerDec 10, 2013

  • CVE-2013-5054
    21Monitor

    Microsoft Office 2013 and 2013 RT allows remote attackers to discover authentication tokens via a crafted response to a file-open request fo

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · officeDec 10, 2013

  • CVE-2013-5056
    43Plan

    Use-after-free vulnerability in the Scripting Runtime Object Library in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · windows 7Dec 10, 2013

  • CVE-2013-5059
    31Monitor

    Microsoft SharePoint Server 2010 SP1 and SP2 and 2013, and Office Web Apps 2013, allows remote attackers to execute arbitrary code via craft

    MediumCVSS 6.8No exploitEPSS 14%

    microsoft · office web appsDec 10, 2013

  • CVE-2013-3900
    65This week

    WinVerifyTrust Signature Validation Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 44%

    microsoft · windows 10 1507Dec 11, 2013

  • CVE-2013-5331
    59Plan

    Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, A

    CriticalCVSS 9.3WeaponizedEPSS 72%

    adobe · flash playerDec 11, 2013

  • CVE-2013-5618
    42Plan

    Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla

    CriticalCVSS 9.8No exploitEPSS 10%

    mozilla · firefoxDec 11, 2013

  • CVE-2013-6671
    42Plan

    The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonk

    CriticalCVSS 9.8No exploitEPSS 11%

    mozilla · firefoxDec 11, 2013

  • CVE-2013-6810
    45Plan

    The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition (CMCNE), HP B-series SAN Ne

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    emc · connectrix managerDec 12, 2013

  • CVE-2011-4971
    40Plan

    Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) pro

    MediumCVSS 5.0WeaponizedEPSS 22%

    memcached · memcachedDec 12, 2013

  • CVE-2013-2751
    61This week

    Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4

    CriticalCVSS 10.0WeaponizedEPSS 71%

    netgear · raidiatorDec 12, 2013

  • CVE-2013-4988
    57Plan

    Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDI

    CriticalCVSS 9.3WeaponizedEPSS 66%

    icofx · icofxDec 13, 2013

  • CVE-2013-7091
    46Plan

    Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2

    MediumCVSS 5.0WeaponizedEPSS 86%

    synacor · zimbra collaboration suiteDec 13, 2013

  • CVE-2013-6271
    40Plan

    Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invok

    HighCVSS 8.8WeaponizedEPSS 8%

    google · androidDec 14, 2013

  • CVE-2013-3140
    44Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerDec 16, 2013

  • CVE-2013-6420
    41Plan

    The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properl

    HighCVSS 7.5Proof of conceptEPSS 35%

    php · phpDec 17, 2013

  • CVE-2013-4775
    35Monitor

    NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier; GS748Tv4 with firmware 5.4.1.14; GS510TP with firmware 5.4.0.6; GS

    HighCVSS 7.8Proof of conceptEPSS 14%

    netgear · prosafe firmwareDec 19, 2013

  • CVE-2013-6877
    40Plan

    Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allows remote atta

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    realnetworks · realplayerDec 19, 2013

  • CVE-2013-7186
    40Plan

    Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long string in a .m3u fil

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    steinberg · mymp3proDec 20, 2013

  • CVE-2013-6449
    23Monitor

    The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, w

    MediumCVSS 4.3No exploitEPSS 21%

    openssl · opensslDec 23, 2013

  • CVE-2013-7102
    40Plan

    Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php

    MediumCVSS 6.8WeaponizedEPSS 14%

    optimizepress · optimizepressDec 23, 2013

  • CVE-2013-3846
    44Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of

    CriticalCVSS 9.3Proof of conceptEPSS 21%

    microsoft · internet explorerDec 29, 2013

  • CVE-2013-6189
    45Plan

    Unspecified vulnerability in the Archive Query Server in HP Application Information Optimizer (formerly HP Database Archiving) 6.2, 6.3, 6.4

    CriticalCVSS 10.0No exploitEPSS 16%

    hp · application information optimizerDec 29, 2013

  • CVE-2013-4858
    21Monitor

    Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) via a cr

    MediumCVSS 4.3Proof of conceptEPSS 13%

    microsoft · windows movie makerDec 30, 2013

  • CVE-2013-6987
    34Monitor

    Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 al

    HighCVSS 7.5Proof of conceptEPSS 14%

    synology · diskstation managerDec 31, 2013

  • CVE-2012-0261
    62This week

    license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary command

    CriticalCVSS 10.0WeaponizedEPSS 73%

    op5 · monitorDec 31, 2013

  • CVE-2012-0262
    62This week

    op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrar

    CriticalCVSS 10.0WeaponizedEPSS 72%

    op5 · monitorDec 31, 2013