Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2014

63 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2012-6636
    40Plan

    The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arb

    MediumCVSS 6.8WeaponizedEPSS 38%

    google · android apiMar 3, 2014

  • CVE-2013-4710
    50Plan

    Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView c

    CriticalCVSS 9.3WeaponizedEPSS 43%

    google · androidMar 3, 2014

  • CVE-2014-1881
    33Monitor

    Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions

    HighCVSS 7.5No exploitEPSS 11%

    apache · cordovaMar 3, 2014

  • CVE-2014-1882
    34Monitor

    Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions

    HighCVSS 7.5No exploitEPSS 11%

    adobe · phonegapMar 3, 2014

  • CVE-2013-4977
    45Plan

    Buffer overflow in the RTSP Packet Handler in Hikvision DS-2CD7153-E IP camera with firmware 4.1.0 b130111 (Jan 2013), and possibly other de

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    hikvision · ds-2cd7153-e firmwareMar 3, 2014

  • CVE-2014-2013
    34Monitor

    Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 14%

    artifex · mupdfMar 3, 2014

  • CVE-2014-2206
    58Plan

    Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a deni

    CriticalCVSS 10.0WeaponizedEPSS 61%

    getgosoft · getgo download managerMar 5, 2014

  • CVE-2014-2238
    40Plan

    SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authent

    MediumCVSS 6.5WeaponizedEPSS 11%

    mantisbt · mantisbtMar 5, 2014

  • CVE-2013-6719
    32Monitor

    delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2

    MediumCVSS 6.0Proof of conceptEPSS 26%

    ibm · tealeaf cxMar 6, 2014

  • CVE-2013-6720
    31Monitor

    Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.

    MediumCVSS 5.5Proof of conceptEPSS 29%

    ibm · tealeaf cxMar 6, 2014

  • CVE-2014-0683
    43Plan

    The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    cisco · rv110w firmwareMar 6, 2014

  • CVE-2014-1907
    28Monitor

    Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote

    MediumCVSS 6.4Proof of conceptEPSS 11%

    videowhisper · live streaming integration pluginMar 6, 2014

  • CVE-2014-0092
    32Monitor

    lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certifica

    MediumCVSS 5.8No exploitEPSS 29%

    gnu · gnutlsMar 6, 2014

  • CVE-2014-2314
    40Plan

    Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary f

    MediumCVSS 4.3WeaponizedEPSS 26%

    atlassian · jiraMar 9, 2014

  • CVE-2014-0094
    50Plan

    The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter,

    MediumCVSS 5.0WeaponizedEPSS 99%

    apache · strutsMar 11, 2014

  • CVE-2013-6031
    40Plan

    The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to chang

    MediumCVSS 4.3WeaponizedEPSS 6%

    huawei · e355 firmwareMar 11, 2014

  • CVE-2014-2299
    51Plan

    Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 all

    CriticalCVSS 9.3WeaponizedEPSS 47%

    wireshark · wiresharkMar 11, 2014

  • CVE-2014-2321
    58Plan

    web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonst

    CriticalCVSS 10.0Proof of conceptEPSS 59%

    zte · f460Mar 11, 2014

  • CVE-2013-3928
    48Plan

    Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote attackers to execute arb

    CriticalCVSS 9.3WeaponizedEPSS 37%

    jpchacha · chasys draw iesMar 11, 2014

  • CVE-2013-4467
    40Plan

    Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and

    MediumCVSS 6.5WeaponizedEPSS 31%

    vicidial · vicidialMar 11, 2014

  • CVE-2014-0297
    43Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0298
    41Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0299
    43Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0301
    41Plan

    Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Window

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · windows 7Mar 12, 2014

  • CVE-2014-0302
    43Plan

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0303
    43Plan

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0304
    43Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0305
    41Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0306
    41Plan

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0307
    58Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service

    CriticalCVSS 9.3WeaponizedEPSS 69%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0308
    41Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0309
    43Plan

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0311
    41Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0312
    43Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0313
    44Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0314
    43Plan

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0317
    24Monitor

    The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis

    MediumCVSS 5.4No exploitEPSS 10%

    microsoft · windows server 2003Mar 12, 2014

  • CVE-2014-0321
    41Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0324
    43Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerMar 12, 2014

  • CVE-2014-0781
    45Plan

    Yokogawa CENTUM CS 3000 Heap-based Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 25%

    yokogawa · centum cs 3000Mar 14, 2014

  • CVE-2014-0783
    56Plan

    Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow

    CriticalCVSS 9.0WeaponizedEPSS 67%

    yokogawa · centum cs 3000Mar 14, 2014

  • CVE-2014-0784
    44Plan

    Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow

    HighCVSS 8.3WeaponizedEPSS 35%

    yokogawa · centum cs 3000Mar 14, 2014

  • CVE-2014-2323
    58Plan

    SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the

    CriticalCVSS 9.8Proof of conceptEPSS 62%

    lighttpd · lighttpdMar 14, 2014

  • CVE-2014-2324
    29Monitor

    Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to

    MediumCVSS 5.0Proof of conceptEPSS 29%

    lighttpd · lighttpdMar 14, 2014

  • CVE-2013-6438
    28Monitor

    The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespa

    MediumCVSS 5.0No exploitEPSS 27%

    apache · http serverMar 18, 2014

  • CVE-2014-0098
    28Monitor

    The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to c

    MediumCVSS 5.0No exploitEPSS 26%

    apache · http serverMar 18, 2014

  • CVE-2014-2533
    40Plan

    /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name

    HighCVSS 7.2WeaponizedEPSS 2%

    blackberry · qnx neutrino rtosMar 18, 2014

  • CVE-2013-2641
    41Plan

    Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via

    MediumCVSS 5.0WeaponizedEPSS 70%

    sophos · web appliance firmwareMar 18, 2014

  • CVE-2014-2087
    42Plan

    Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build

    CriticalCVSS 9.3Proof of conceptEPSS 16%

    freedownloadmanager · free download managerMar 18, 2014

  • CVE-2014-2120
    61This week

    Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attacker

    MediumCVSS 6.1KEVWeaponizedEPSS 22%

    cisco · adaptive security appliance softwareMar 18, 2014

  • CVE-2014-1510
    64This week

    The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25

    CriticalCVSS 9.8WeaponizedEPSS 82%

    mozilla · firefoxMar 19, 2014

  • CVE-2014-1511
    64This week

    Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypa

    CriticalCVSS 9.8WeaponizedEPSS 83%

    mozilla · firefoxMar 19, 2014

  • CVE-2014-1512
    49Plan

    Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4,

    CriticalCVSS 10.0No exploitEPSS 29%

    mozilla · firefoxMar 19, 2014

  • CVE-2014-0002
    38Monitor

    The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have

    HighCVSS 7.5No exploitEPSS 27%

    apache · camelMar 21, 2014

  • CVE-2014-2497
    23Monitor

    The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of servi

    MediumCVSS 4.3No exploitEPSS 20%

    php · phpMar 21, 2014

  • CVE-2014-2523
    43Plan

    net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attac

    CriticalCVSS 10.0No exploitEPSS 10%

    linux · linux kernelMar 24, 2014

  • CVE-2012-4886
    45Plan

    Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238 allows remote attackers to execute arbitrary code v

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    kingsoft · office 2012Mar 24, 2014

  • CVE-2014-1761
    84Now

    Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Wor

    HighCVSS 7.8KEVWeaponizedEPSS 77%

    microsoft · officeMar 25, 2014

  • CVE-2013-1605
    34Monitor

    Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitrary code via a long f

    HighCVSS 7.5Proof of conceptEPSS 11%

    maygion · ip camera firmwareMar 25, 2014

  • CVE-2014-1303
    50Plan

    Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism

    CriticalCVSS 10.0Proof of conceptEPSS 34%

    apple · safariMar 26, 2014

  • CVE-2014-2668
    27Monitor

    Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter t

    MediumCVSS 5.0Proof of conceptEPSS 22%

    apache · couchdbMar 28, 2014

  • CVE-2014-0983
    40Plan

    Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in

    MediumCVSS 6.9WeaponizedEPSS 8%

    oracle · vm virtualboxMar 31, 2014

  • CVE-2014-2671
    41Plan

    Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly hav

    MediumCVSS 6.8Proof of conceptEPSS 46%

    microsoft · windows media playerMar 31, 2014