Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2014

50 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2013-0662
    44Plan

    Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to

    CriticalCVSS 9.3Proof of conceptEPSS 22%

    schneider electric · somachineApr 1, 2014

  • CVE-2014-0050
    60This week

    MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attac

    HighCVSS 7.5WeaponizedEPSS 83%

    apache · commons fileuploadApr 1, 2014

  • CVE-2014-1691
    43Plan

    The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object inject

    HighCVSS 7.5WeaponizedEPSS 42%

    horde · horde application frameworkApr 1, 2014

  • CVE-2012-6429
    45Plan

    Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7 allows remote attack

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    samsung · kiesApr 4, 2014

  • CVE-2014-2730
    23Monitor

    The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during

    MediumCVSS 5.0No exploitEPSS 11%

    microsoft · officeApr 5, 2014

  • CVE-2014-0160
    90Now

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    openssl · opensslApr 7, 2014

  • CVE-2014-0315
    31Monitor

    Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2

    MediumCVSS 6.9No exploitEPSS 14%

    microsoft · windows 7Apr 8, 2014

  • CVE-2014-1751
    43Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerApr 8, 2014

  • CVE-2014-1752
    43Plan

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerApr 8, 2014

  • CVE-2014-1753
    43Plan

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerApr 8, 2014

  • CVE-2014-1755
    43Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerApr 8, 2014

  • CVE-2014-1757
    42Plan

    Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a bi

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · office compatibility packApr 8, 2014

  • CVE-2014-1758
    42Plan

    Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Micros

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · wordApr 8, 2014

  • CVE-2014-1759
    41Plan

    pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (inc

    CriticalCVSS 9.3No exploitEPSS 14%

    microsoft · publisherApr 8, 2014

  • CVE-2014-1760
    41Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerApr 8, 2014

  • CVE-2014-2127
    40Plan

    Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0

    HighCVSS 8.5WeaponizedEPSS 11%

    cisco · adaptive security appliance softwareApr 10, 2014

  • CVE-2014-2849
    52Plan

    The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin

    HighCVSS 8.5WeaponizedEPSS 60%

    sophos · web appliance firmwareApr 11, 2014

  • CVE-2014-2850
    51Plan

    The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitra

    HighCVSS 8.5WeaponizedEPSS 57%

    sophos · web appliance firmwareApr 11, 2014

  • CVE-2014-0763
    40Plan

    Advantech WebAccess SQL Injection

    HighCVSS 7.5WeaponizedEPSS 15%

    advantech · advantech webaccessApr 12, 2014

  • CVE-2014-0787
    44Plan

    WellinTech KingSCADA Stack-based Buffer Overflow

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    wellintech · kingscadaApr 12, 2014

  • CVE-2014-0128
    30Monitor

    Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion fail

    MediumCVSS 5.0No exploitEPSS 32%

    squid-cache · squidApr 14, 2014

  • CVE-2010-5298
    26Monitor

    Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remot

    MediumCVSS 4.0No exploitEPSS 34%

    openssl · opensslApr 14, 2014

  • CVE-2013-5704
    37Monitor

    The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a head

    MediumCVSS 5.0No exploitEPSS 56%

    apache · http serverApr 15, 2014

  • CVE-2014-0107
    34Monitor

    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESS

    HighCVSS 7.5No exploitEPSS 14%

    apache · xalan-javaApr 15, 2014

  • CVE-2014-0514
    59Plan

    The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to e

    CriticalCVSS 9.3WeaponizedEPSS 72%

    adobe · adobe readerApr 15, 2014

  • CVE-2014-2424
    40Plan

    Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users

    MediumCVSS 4.0WeaponizedEPSS 48%

    oracle · fusion middlewareApr 15, 2014

  • CVE-2013-4694
    35Monitor

    Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash)

    HighCVSS 7.5Proof of conceptEPSS 17%

    nullsoft · winampApr 16, 2014

  • CVE-2014-0644
    47Plan

    EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML

    HighCVSS 7.8WeaponizedEPSS 53%

    emc · cloud tiering appliance softwareApr 16, 2014

  • CVE-2013-2143
    40Plan

    The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which

    MediumCVSS 6.5WeaponizedEPSS 48%

    redhat · network satelliteApr 17, 2014

  • CVE-2014-0054
    54Plan

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external ent

    MediumCVSS 6.8No exploitEPSS 91%

    springsource · spring frameworkApr 17, 2014

  • CVE-2014-2286
    35Monitor

    main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x befo

    HighCVSS 7.5No exploitEPSS 16%

    digium · asteriskApr 18, 2014

  • CVE-2013-6213
    43Plan

    Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · loadrunnerApr 19, 2014

  • CVE-2014-2269
    30Monitor

    modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via

    MediumCVSS 6.4No exploitEPSS 15%

    vtiger · vtiger crmApr 22, 2014

  • CVE-2011-5279
    26Monitor

    CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Window

    MediumCVSS 5.0No exploitEPSS 19%

    microsoft · internet information servicesApr 23, 2014

  • CVE-2014-0780
    91Now

    InduSoft Web Studio Path Traversal

    CriticalCVSS 9.8KEVWeaponizedEPSS 74%

    indusoft · web studioApr 25, 2014

  • CVE-2014-2908
    23Monitor

    Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attac

    MediumCVSS 4.3Proof of conceptEPSS 20%

    siemens · simatic s7 cpu 1200 firmwareApr 25, 2014

  • CVE-2013-5660
    40Plan

    Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file.

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    powersoftware · winarchiverApr 25, 2014

  • CVE-2014-2994
    47Plan

    Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code v

    CriticalCVSS 10.0Proof of conceptEPSS 23%

    acunetix · web vulnerability scannerApr 27, 2014

  • CVE-2014-1762
    51Plan

    Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrit

    HighCVSS 7.5Proof of conceptEPSS 71%

    microsoft · internet explorerApr 27, 2014

  • CVE-2014-1763
    47Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code and bypass a sand

    CriticalCVSS 10.0No exploitEPSS 22%

    microsoft · internet explorerApr 27, 2014

  • CVE-2014-1764
    51Plan

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leve

    CriticalCVSS 10.0Proof of conceptEPSS 37%

    microsoft · internet explorerApr 27, 2014

  • CVE-2014-1765
    35Monitor

    Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 6 through 11 allow remote attackers to execute arbitrary code via uns

    HighCVSS 7.6No exploitEPSS 15%

    microsoft · internet explorerApr 27, 2014

  • CVE-2014-1766
    47Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    microsoft · internet explorerApr 27, 2014

  • CVE-2014-1776
    94Now

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial

    CriticalCVSS 9.8KEVWeaponizedEPSS 82%

    microsoft · internet explorerApr 27, 2014

  • CVE-2014-3007
    43Plan

    Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharact

    CriticalCVSS 10.0No exploitEPSS 10%

    python · pillowApr 27, 2014

  • CVE-2014-2383
    39Monitor

    dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and re

    MediumCVSS 6.8Proof of conceptEPSS 39%

    dompdf · dompdfApr 28, 2014

  • CVE-2014-0112
    59Plan

    ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers

    HighCVSS 7.5WeaponizedEPSS 98%

    apache · strutsApr 29, 2014

  • CVE-2014-0113
    53Plan

    CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getCla

    HighCVSS 7.5Proof of conceptEPSS 78%

    apache · strutsApr 29, 2014

  • CVE-2014-0515
    68This week

    Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.2

    CriticalCVSS 10.0WeaponizedEPSS 94%

    adobe · flash playerApr 29, 2014

  • CVE-2014-0114
    60This week

    Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir

    HighCVSS 7.5WeaponizedEPSS 99%

    apache · commons beanutilsApr 30, 2014