Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2014

39 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2014-3000
    35Monitor

    The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 a

    HighCVSS 7.8No exploitEPSS 12%

    freebsd · freebsdMay 2, 2014

  • CVE-2014-3220
    39Monitor

    F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name pa

    CriticalCVSS 9.0Proof of conceptEPSS 11%

    f5 · big-iqMay 5, 2014

  • CVE-2014-0198
    29Monitor

    The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a b

    MediumCVSS 4.3No exploitEPSS 40%

    openssl · opensslMay 6, 2014

  • CVE-2014-0130
    76This week

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails befor

    HighCVSS 7.5KEVWeaponizedEPSS 53%

    redhat · subscription asset managerMay 7, 2014

  • CVE-2014-0196
    59Plan

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO

    MediumCVSS 5.5KEVWeaponizedEPSS 22%

    linux · linux kernelMay 7, 2014

  • CVE-2014-2913
    35Monitor

    Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arb

    HighCVSS 7.5Proof of conceptEPSS 15%

    nagios · remote plugin executorMay 7, 2014

  • CVE-2014-3214
    25Monitor

    The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial o

    MediumCVSS 5.0No exploitEPSS 17%

    isc · bindMay 8, 2014

  • CVE-2014-2928
    40Plan

    The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.

    HighCVSS 7.1WeaponizedEPSS 40%

    f5 · big-ip webacceleratorMay 12, 2014

  • CVE-2013-4490
    40Plan

    The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allow

    MediumCVSS 6.5WeaponizedEPSS 42%

    gitlab · gitlabMay 13, 2014

  • CVE-2014-1849
    44Plan

    Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdo

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    foscam · ip camera firmwareMay 13, 2014

  • CVE-2014-0251
    40Plan

    Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 20

    CriticalCVSS 9.0No exploitEPSS 14%

    microsoft · office web apps serverMay 14, 2014

  • CVE-2014-0255
    33Monitor

    Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (iSCSI service

    MediumCVSS 5.0No exploitEPSS 41%

    microsoft · windows server 2008May 14, 2014

  • CVE-2014-0256
    33Monitor

    Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold allow remote attackers to cause a denial of service (iSCSI service outage)

    MediumCVSS 5.0No exploitEPSS 41%

    microsoft · windows server 2008May 14, 2014

  • CVE-2014-0310
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · internet explorerMay 14, 2014

  • CVE-2014-0527
    44Plan

    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to

    CriticalCVSS 10.0No exploitEPSS 13%

    adobe · acrobatMay 14, 2014

  • CVE-2014-1754
    20Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office W

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · office web apps serverMay 14, 2014

  • CVE-2014-1806
    52Plan

    The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memo

    CriticalCVSS 10.0Proof of conceptEPSS 39%

    microsoft · .net frameworkMay 14, 2014

  • CVE-2014-1808
    20Monitor

    Microsoft Office 2013 Gold, SP1, RT, and RT SP1 allows remote attackers to obtain sensitive token information via a web site that sends a cr

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · officeMay 14, 2014

  • CVE-2014-1809
    30Monitor

    The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers

    MediumCVSS 6.8No exploitEPSS 10%

    microsoft · officeMay 14, 2014

  • CVE-2014-1812
    85Now

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, a

    HighCVSS 8.8KEVWeaponizedEPSS 65%

    microsoft · windows 7May 14, 2014

  • CVE-2014-1813
    37Monitor

    Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content, aka "Web A

    HighCVSS 8.5No exploitEPSS 10%

    microsoft · web applicationsMay 14, 2014

  • CVE-2014-1815
    43Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    microsoft · internet explorerMay 14, 2014

  • CVE-2013-4468
    40Plan

    VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands

    MediumCVSS 6.5WeaponizedEPSS 32%

    vicidial · vicidialMay 14, 2014

  • CVE-2013-4730
    60This week

    Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.

    CriticalCVSS 10.0WeaponizedEPSS 66%

    pcman · ftp serverMay 15, 2014

  • CVE-2014-0782
    50Plan

    Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow

    HighCVSS 8.3WeaponizedEPSS 56%

    yokogawa · b\/m9000cs softwareMay 16, 2014

  • CVE-2014-1649
    44Plan

    The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a cra

    HighCVSS 7.9WeaponizedEPSS 42%

    symantec · workspace streamingMay 16, 2014

  • CVE-2014-0749
    45Plan

    Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    adaptivecomputing · torque resource managerMay 16, 2014

  • CVE-2014-3791
    64This week

    Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in

    CriticalCVSS 10.0WeaponizedEPSS 78%

    efssoft · easy file sharing web serverMay 20, 2014

  • CVE-2014-3802
    30Monitor

    msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate a

    MediumCVSS 6.8No exploitEPSS 10%

    microsoft · debug interface access software development kitMay 20, 2014

  • CVE-2014-1770
    47Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaS

    CriticalCVSS 9.3Proof of conceptEPSS 34%

    microsoft · internet explorerMay 22, 2014

  • CVE-2014-3789
    49Plan

    GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspeci

    HighCVSS 7.5WeaponizedEPSS 63%

    cogentdatahub · cogent datahubMay 22, 2014

  • CVE-2010-5299
    40Plan

    Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file.

    MediumCVSS 6.8WeaponizedEPSS 33%

    microp project · micropMay 22, 2014

  • CVE-2013-3975
    40Plan

    Unspecified vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to disco

    MediumCVSS 5.0WeaponizedEPSS 13%

    ibm · sametimeMay 26, 2014

  • CVE-2013-3977
    40Plan

    The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are

    MediumCVSS 4.3WeaponizedEPSS 9%

    ibm · sametimeMay 26, 2014

  • CVE-2013-3982
    40Plan

    The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to obtain unspecified installation in

    MediumCVSS 5.0WeaponizedEPSS 13%

    ibm · sametimeMay 26, 2014

  • CVE-2013-5036
    44Plan

    The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation

    HighCVSS 7.5WeaponizedEPSS 46%

    squash · square squashMay 27, 2014

  • CVE-2014-0239
    40Plan

    The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sendi

    MediumCVSS 5.0No exploitEPSS 66%

    samba · sambaMay 28, 2014

  • CVE-2012-4915
    40Plan

    Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary fil

    MediumCVSS 5.0WeaponizedEPSS 50%

    wordpress · wordpressMay 29, 2014

  • CVE-2014-0075
    25Monitor

    Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6

    MediumCVSS 5.0Proof of conceptEPSS 17%

    apache · tomcatMay 31, 2014