By publication date

Exploited and new serious CVEs: February 2014

48 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
99Now	CVE-2014-0497Weaponized	Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1adobe · flash player · CWE-191 pre-auth RCE Memory safety	Critical9.8	KEV	99.8%	Feb 5, 2014
20Monitor	CVE-2013-4449No exploit	The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial openldap · openldap · CWE-189 Pre-auth Denial of service	Medium4.3	—	10.9%	Feb 5, 2014
44Plan	CVE-2013-6490Proof of concept	The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Lengtpidgin · pidgin · CWE-119 Pre-auth Memory safety	Critical10.0	—	14.8%	Feb 6, 2014
40Plan	CVE-2014-0038Weaponized	The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to galinux · linux kernel · CWE-20 Local privilege escalation	Medium6.9	—	35.4%	Feb 6, 2014
49Plan	CVE-2014-0980Weaponized	Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.poster software · publish it · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	40.3%	Feb 11, 2014
32Monitor	CVE-2014-0253No exploit	Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remmicrosoft · .net framework · CWE-20 Pre-auth Denial of service	Medium5.0	—	38.6%	Feb 12, 2014
41Plan	CVE-2014-0254No exploit	The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote microsoft · windows 8 · CWE-20 Pre-auth Denial of service	High7.8	—	32.6%	Feb 12, 2014
58Plan	CVE-2014-0257Weaponized	Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute microsoft · .net framework · CWE-20 pre-auth RCE	Critical9.3	—	69.8%	Feb 12, 2014
43Plan	CVE-2014-0263No exploit	The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2,microsoft · windows 7 · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.8%	Feb 12, 2014
34Monitor	CVE-2014-0266No exploit	The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windomicrosoft · windows 7 · CWE-200 Pre-auth Info leak	High7.1	—	19.4%	Feb 12, 2014
42Plan	CVE-2014-0267No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	17.3%	Feb 12, 2014
24Monitor	CVE-2014-0268No exploit	Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attackemicrosoft · internet explorer · CWE-264 Pre-auth	Medium4.3	—	22.4%	Feb 12, 2014
42Plan	CVE-2014-0269No exploit	Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	17.3%	Feb 12, 2014
45Plan	CVE-2014-0270No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.2%	Feb 12, 2014
49Plan	CVE-2014-0271No exploit	The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	38.4%	Feb 12, 2014
42Plan	CVE-2014-0272No exploit	Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	17.3%	Feb 12, 2014
44Plan	CVE-2014-0273No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	22.8%	Feb 12, 2014
44Plan	CVE-2014-0274No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	23.5%	Feb 12, 2014
44Plan	CVE-2014-0275No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	22.8%	Feb 12, 2014
44Plan	CVE-2014-0276No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	22.8%	Feb 12, 2014
45Plan	CVE-2014-0277No exploit	Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.2%	Feb 12, 2014
42Plan	CVE-2014-0278No exploit	Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.8%	Feb 12, 2014
44Plan	CVE-2014-0279No exploit	Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	22.8%	Feb 12, 2014
42Plan	CVE-2014-0280No exploit	Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.8%	Feb 12, 2014
45Plan	CVE-2014-0281No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.4%	Feb 12, 2014
45Plan	CVE-2014-0283No exploit	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.4%	Feb 12, 2014
44Plan	CVE-2014-0284No exploit	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	24.7%	Feb 12, 2014
44Plan	CVE-2014-0285No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	24.7%	Feb 12, 2014
45Plan	CVE-2014-0286No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.4%	Feb 12, 2014
45Plan	CVE-2014-0287No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.7%	Feb 12, 2014
45Plan	CVE-2014-0288No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.4%	Feb 12, 2014
46Plan	CVE-2014-0289No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	28.4%	Feb 12, 2014
44Plan	CVE-2014-0290No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	24.8%	Feb 12, 2014
22Monitor	CVE-2014-0293No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web smicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	17.5%	Feb 12, 2014
46Plan	CVE-2014-0294No exploit	Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to executmicrosoft · microsoft forefront protection 2010 · CWE-94 pre-auth RCE	Critical10.0	—	20.8%	Feb 12, 2014
21Monitor	CVE-2014-0295No exploit	VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remotmicrosoft · .net framework · CWE-264 pre-auth RCE	Medium4.3	—	13.7%	Feb 12, 2014
50Plan	CVE-2013-5014Weaponized	The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantesymantec · endpoint protection manager Pre-auth XXE	High7.5	—	67.5%	Feb 14, 2014
40Plan	CVE-2013-5015Weaponized	SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 befsymantec · endpoint protection manager · CWE-89 RCE SQL injection	Medium6.5	—	28.7%	Feb 14, 2014
20Monitor	CVE-2014-0032No exploit	The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentapache · subversion · CWE-20 Pre-auth Denial of service	Medium4.3	—	11.0%	Feb 14, 2014
91Now	CVE-2014-0322Weaponized	Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involvingmicrosoft · internet explorer · CWE-416 pre-auth RCE Memory safety	High8.8	KEV	85.1%	Feb 14, 2014
46Plan	CVE-2012-0270Weaponized	Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file csounds · csound · CWE-119 pre-auth RCE Memory safety	High7.5	—	54.6%	Feb 17, 2014
46Plan	CVE-2014-1903Weaponized	admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22freepbx · freepbx · CWE-264 pre-auth RCE	High7.5	—	51.8%	Feb 18, 2014
72This week	CVE-2014-0502Weaponized	Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and badobe · flash player · CWE-415 pre-auth RCE Memory safety	High8.8	KEV	24.8%	Feb 21, 2014
43Plan	CVE-2013-4841No exploit	Unspecified vulnerability in dbd_manager in LeftHand OS before 11.0 in HP StoreVirtual 4000 and StoreVirtual VSA Software (formerly LeftHandhp · lefthand pre-auth RCE	Critical10.0	—	10.4%	Feb 26, 2014
71This week	CVE-2013-7331Weaponized	The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnamicrosoft · internet explorer · CWE-209 Pre-auth Info leak	Medium6.5	KEV	50.2%	Feb 26, 2014
24Monitor	CVE-2013-7332No exploit	The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which microsoft · windows 8 · CWE-399 Pre-auth Denial of service	Medium5.0	—	13.3%	Feb 26, 2014
28Monitor	CVE-2013-4286No exploit	Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properlyapache · tomcat · CWE-20 Pre-auth	Medium5.8	—	16.2%	Feb 26, 2014
38Monitor	CVE-2014-1912Proof of concept	Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x beforpython · python · CWE-119 pre-auth RCE Memory safety	High7.5	—	28.1%	Feb 28, 2014

CVE-2014-0497
99Now
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 5, 2014
CVE-2013-4449
20Monitor
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial
MediumCVSS 4.3No exploitEPSS 10%
- Pre-auth
- Denial of service
openldap · openldapFeb 5, 2014
CVE-2013-6490
44Plan
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Lengt
CriticalCVSS 10.0Proof of conceptEPSS 14%
- Pre-auth
- Memory safety
pidgin · pidginFeb 6, 2014
CVE-2014-0038
40Plan
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to ga
MediumCVSS 6.9WeaponizedEPSS 35%
- Local privilege escalation
linux · linux kernelFeb 6, 2014
CVE-2014-0980
49Plan
Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.
CriticalCVSS 9.3WeaponizedEPSS 40%
- pre-auth RCE
- Memory safety
poster software · publish itFeb 11, 2014
CVE-2014-0253
32Monitor
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows rem
MediumCVSS 5.0No exploitEPSS 38%
- Pre-auth
- Denial of service
microsoft · .net frameworkFeb 12, 2014
CVE-2014-0254
41Plan
The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote
HighCVSS 7.8No exploitEPSS 32%
- Pre-auth
- Denial of service
microsoft · windows 8Feb 12, 2014
CVE-2014-0257
58Plan
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute
CriticalCVSS 9.3WeaponizedEPSS 69%
- pre-auth RCE
microsoft · .net frameworkFeb 12, 2014
CVE-2014-0263
43Plan
The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2,
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · windows 7Feb 12, 2014
CVE-2014-0266
34Monitor
The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windo
HighCVSS 7.1No exploitEPSS 19%
- Pre-auth
- Info leak
microsoft · windows 7Feb 12, 2014
CVE-2014-0267
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0268
24Monitor
Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attacke
MediumCVSS 4.3No exploitEPSS 22%
- Pre-auth
microsoft · internet explorerFeb 12, 2014
CVE-2014-0269
42Plan
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0270
45Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0271
49Plan
The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary
CriticalCVSS 9.3No exploitEPSS 38%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0272
42Plan
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0273
44Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0274
44Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0275
44Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0276
44Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0277
45Plan
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0278
42Plan
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0279
44Plan
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0280
42Plan
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0281
45Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0283
45Plan
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0284
44Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 24%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0285
44Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 24%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0286
45Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0287
45Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0288
45Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0289
46Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 28%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0290
44Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 24%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 12, 2014
CVE-2014-0293
22Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s
MediumCVSS 4.3No exploitEPSS 17%
- Pre-auth
- Info leak
microsoft · internet explorerFeb 12, 2014
CVE-2014-0294
46Plan
Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execut
CriticalCVSS 10.0No exploitEPSS 20%
- pre-auth RCE
microsoft · microsoft forefront protection 2010Feb 12, 2014
CVE-2014-0295
21Monitor
VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remot
MediumCVSS 4.3No exploitEPSS 13%
- pre-auth RCE
microsoft · .net frameworkFeb 12, 2014
CVE-2013-5014
50Plan
The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symante
HighCVSS 7.5WeaponizedEPSS 67%
- Pre-auth
- XXE
symantec · endpoint protection managerFeb 14, 2014
CVE-2013-5015
40Plan
SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 bef
MediumCVSS 6.5WeaponizedEPSS 28%
- RCE
- SQL injection
symantec · endpoint protection managerFeb 14, 2014
CVE-2014-0032
20Monitor
The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParent
MediumCVSS 4.3No exploitEPSS 11%
- Pre-auth
- Denial of service
apache · subversionFeb 14, 2014
CVE-2014-0322
91Now
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving
HighCVSS 8.8KEVWeaponizedEPSS 85%
- pre-auth RCE
- Memory safety
microsoft · internet explorerFeb 14, 2014
CVE-2012-0270
46Plan
Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file
HighCVSS 7.5WeaponizedEPSS 54%
- pre-auth RCE
- Memory safety
csounds · csoundFeb 17, 2014
CVE-2014-1903
46Plan
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22
HighCVSS 7.5WeaponizedEPSS 51%
- pre-auth RCE
freepbx · freepbxFeb 18, 2014
CVE-2014-0502
72This week
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and b
HighCVSS 8.8KEVWeaponizedEPSS 24%
- pre-auth RCE
- Memory safety
adobe · flash playerFeb 21, 2014
CVE-2013-4841
43Plan
Unspecified vulnerability in dbd_manager in LeftHand OS before 11.0 in HP StoreVirtual 4000 and StoreVirtual VSA Software (formerly LeftHand
CriticalCVSS 10.0No exploitEPSS 10%
- pre-auth RCE
hp · lefthandFeb 26, 2014
CVE-2013-7331
71This week
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathna
MediumCVSS 6.5KEVWeaponizedEPSS 50%
- Pre-auth
- Info leak
microsoft · internet explorerFeb 26, 2014
CVE-2013-7332
24Monitor
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which
MediumCVSS 5.0No exploitEPSS 13%
- Pre-auth
- Denial of service
microsoft · windows 8Feb 26, 2014
CVE-2013-4286
28Monitor
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly
MediumCVSS 5.8No exploitEPSS 16%
- Pre-auth
apache · tomcatFeb 26, 2014
CVE-2014-1912
38Monitor
Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x befor
HighCVSS 7.5Proof of conceptEPSS 28%
- pre-auth RCE
- Memory safety
python · pythonFeb 28, 2014