Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2014

47 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2013-6450
    28Monitor

    The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for

    MediumCVSS 5.8No exploitEPSS 15%

    openssl · opensslJan 1, 2014

  • CVE-2013-5211
    49Plan

    The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplificat

    MediumCVSS 5.0WeaponizedEPSS 97%

    ntp · ntpJan 2, 2014

  • CVE-2013-7240
    26Monitor

    Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read ar

    MediumCVSS 5.0Proof of conceptEPSS 19%

    wordpress · wordpressJan 3, 2014

  • CVE-2013-7260
    50Plan

    Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow r

    HighCVSS 7.5WeaponizedEPSS 66%

    realnetworks · realplayerJan 3, 2014

  • CVE-2013-2344
    43Plan

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-2345
    43Plan

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-2346
    43Plan

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-2347
    60This week

    The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a

    CriticalCVSS 10.0WeaponizedEPSS 66%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-2348
    43Plan

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-2349
    43Plan

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-2350
    43Plan

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-6194
    60This week

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0WeaponizedEPSS 65%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-6195
    43Plan

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · storage data protectorJan 4, 2014

  • CVE-2013-6881
    44Plan

    CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacte

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    cru-inc · ditto forensic fieldstation firmwareJan 7, 2014

  • CVE-2013-6884
    43Plan

    The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allo

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    cru-inc · ditto forensic fieldstation firmwareJan 7, 2014

  • CVE-2013-4353
    21Monitor

    The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL poin

    MediumCVSS 4.3No exploitEPSS 11%

    openssl · opensslJan 8, 2014

  • CVE-2013-6955
    65This week

    webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 al

    CriticalCVSS 10.0WeaponizedEPSS 84%

    synology · diskstation managerJan 9, 2014

  • CVE-2013-6462
    40Plan

    Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attacker

    CriticalCVSS 9.3No exploitEPSS 10%

    x · libxfontJan 9, 2014

  • CVE-2013-2050
    40Plan

    SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virt

    HighCVSS 7.5WeaponizedEPSS 15%

    redhat · cloudforms management engineJan 10, 2014

  • CVE-2014-0659
    62This week

    The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, an

    CriticalCVSS 10.0WeaponizedEPSS 73%

    cisco · rvs4000 firmwareJan 12, 2014

  • CVE-2014-0591
    20Monitor

    The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV b

    LowCVSS 2.6No exploitEPSS 31%

    isc · bindJan 14, 2014

  • CVE-2013-7108
    40Plan

    Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow

    MediumCVSS 5.5Proof of conceptEPSS 61%

    nagios · nagiosJan 15, 2014

  • CVE-2013-2827
    44Plan

    An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote

    HighCVSS 7.5WeaponizedEPSS 48%

    wellintech · kingalarm\&eventJan 15, 2014

  • CVE-2014-1201
    49Plan

    Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 ser

    CriticalCVSS 10.0Proof of conceptEPSS 29%

    lorex technology · edge lh310 firmwareJan 15, 2014

  • CVE-2013-5795
    40Plan

    Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0

    MediumCVSS 5.0WeaponizedEPSS 59%

    oracle · supply chain products suiteJan 15, 2014

  • CVE-2013-5877
    40Plan

    Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0

    MediumCVSS 5.0WeaponizedEPSS 54%

    oracle · supply chain products suiteJan 15, 2014

  • CVE-2013-5880
    40Plan

    Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 12.2.0, 12.2.1, and 12.2.

    MediumCVSS 5.0WeaponizedEPSS 59%

    oracle · supply chain products suiteJan 15, 2014

  • CVE-2014-0258
    42Plan

    Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cau

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · office compatibility packJan 15, 2014

  • CVE-2014-0259
    42Plan

    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (mem

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · office compatibility packJan 15, 2014

  • CVE-2014-0260
    42Plan

    Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 S

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · office compatibility packJan 15, 2014

  • CVE-2014-0261
    19Monitor

    Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage)

    MediumCVSS 4.0No exploitEPSS 10%

    microsoft · dynamics axJan 15, 2014

  • CVE-2014-0496
    77This week

    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers

    HighCVSS 8.8KEVWeaponizedEPSS 39%

    adobe · acrobatJan 15, 2014

  • CVE-2013-7204
    30Monitor

    Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21.37.2.49 allows remo

    MediumCVSS 6.8Proof of conceptEPSS 10%

    conceptronic · cipcamptiwl 1.0 firmwareJan 17, 2014

  • CVE-2013-3482
    46Plan

    Stack-based buffer overflow in the rf_report_error function in ermapper_u.dll in Intergraph ERDAS ER Viewer before 13.0.1.1301 allows remote

    CriticalCVSS 9.3WeaponizedEPSS 31%

    hexagon · erdas er viewerJan 19, 2014

  • CVE-2013-0340
    33Monitor

    expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler fun

    MediumCVSS 6.8No exploitEPSS 19%

    libexpat project · libexpatJan 21, 2014

  • CVE-2013-4152
    35Monitor

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, wh

    MediumCVSS 6.8No exploitEPSS 25%

    springsource · spring frameworkJan 23, 2014

  • CVE-2013-6933
    35Monitor

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Pl

    HighCVSS 7.5No exploitEPSS 17%

    live555 · streaming mediaJan 23, 2014

  • CVE-2013-6934
    38Monitor

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote

    HighCVSS 7.5No exploitEPSS 28%

    live555 · streaming mediaJan 23, 2014

  • CVE-2014-1670
    31Monitor

    The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a craft

    MediumCVSS 6.8No exploitEPSS 13%

    microsoft · bingJan 25, 2014

  • CVE-2014-0750
    51Plan

    GE Proficy HMI/SCADA Path Traversal

    HighCVSS 7.5WeaponizedEPSS 69%

    ge · intelligent platforms proficy hmi\%2fscada cimplicityJan 25, 2014

  • CVE-2013-7137
    44Plan

    The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    burden project · burdenJan 25, 2014

  • CVE-2013-6429
    54Plan

    The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entit

    MediumCVSS 6.8No exploitEPSS 90%

    pivotal software · spring frameworkJan 26, 2014

  • CVE-2012-5192
    40Plan

    Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files vi

    MediumCVSS 5.0WeaponizedEPSS 52%

    bitweaver · bitweaverJan 27, 2014

  • CVE-2014-1683
    40Plan

    The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid pa

    MediumCVSS 6.8WeaponizedEPSS 31%

    skybluecanvas · skybluecanvasJan 29, 2014

  • CVE-2013-0177
    20Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz)

    LowCVSS 3.5Proof of conceptEPSS 21%

    apache · ofbizJan 30, 2014

  • CVE-2013-7246
    40Plan

    Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    daum communications · daumgame activex controlJan 30, 2014

  • CVE-2014-1610
    40Plan

    MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows rem

    MediumCVSS 6.0WeaponizedEPSS 42%

    mediawiki · mediawikiJan 30, 2014