By publication date

Exploited and new serious CVEs: August 2014

68 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2014-0972No exploit	The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and otcodeaurora · android-msm · CWE-264	High7.2	—	0.3%	Aug 1, 2014
35Monitor	CVE-2014-5160No exploit	Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arhp · data protector · CWE-22 Pre-auth Path traversal	Medium6.4	—	34.7%	Aug 1, 2014
40Plan	CVE-2013-5758Proof of concept	cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system myealink · sip-t38g · CWE-78 RCE Command injection	Critical9.0	—	11.8%	Aug 3, 2014
48Plan	CVE-2014-3560No exploit	NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code vsamba · samba · CWE-94 RCE	High7.9	—	56.3%	Aug 6, 2014
30Monitor	CVE-2014-3459No exploit	Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote attackers to execute arbitrary code visolarwinds · network configuration manager · CWE-119 pre-auth RCE Memory safety	Medium6.8	—	11.5%	Aug 7, 2014
62This week	CVE-2014-3914Weaponized	Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to rocketsoftware · rocket servergraph · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	72.6%	Aug 7, 2014
40Plan	CVE-2014-2630Weaponized	Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.hp · operations agent Local privilege escalation	Medium4.4	—	7.0%	Aug 12, 2014
33Monitor	CVE-2014-0316No exploit	Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Wimicrosoft · windows 7 · CWE-399 Pre-auth	High7.5	—	11.4%	Aug 12, 2014
76This week	CVE-2014-0546Weaponized	Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, anadobe · acrobat Pre-auth	Critical9.8	KEV	22.3%	Aug 12, 2014
21Monitor	CVE-2014-1820No exploit	Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows microsoft · sql server · CWE-79 Pre-auth XSS	Medium4.3	—	14.7%	Aug 12, 2014
42Plan	CVE-2014-2774No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2784No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2796No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2808No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2810No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.4%	Aug 12, 2014
42Plan	CVE-2014-2811No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.4%	Aug 12, 2014
48Plan	CVE-2014-2815Proof of concept	Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executamicrosoft · onenote pre-auth RCE	High8.8	—	43.7%	Aug 12, 2014
42Plan	CVE-2014-2816No exploit	Microsoft SharePoint Server 2013 Gold and SP1 and SharePoint Foundation 2013 Gold and SP1 allow remote authenticated users to gain privilegemicrosoft · sharepoint foundation · CWE-264 Pre-auth	Critical9.3	—	16.1%	Aug 12, 2014
73This week	CVE-2014-2817Weaponized	Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevationmicrosoft · internet explorer Pre-auth	High8.8	KEV	26.3%	Aug 12, 2014
42Plan	CVE-2014-2818No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
31Monitor	CVE-2014-2819No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevationmicrosoft · internet explorer · CWE-264 Pre-auth	Medium6.8	—	11.6%	Aug 12, 2014
42Plan	CVE-2014-2820No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2821No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2822No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.4%	Aug 12, 2014
42Plan	CVE-2014-2823No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.4%	Aug 12, 2014
42Plan	CVE-2014-2824No exploit	Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2825No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2826No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-2827No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-4050No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-4051No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-4052No exploit	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-4055No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-4056No exploit	Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
42Plan	CVE-2014-4057No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.4%	Aug 12, 2014
42Plan	CVE-2014-4058No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
34Monitor	CVE-2014-4060No exploit	Use-after-free vulnerability in MCPlayer.dll in Microsoft Windows Media Center TV Pack for Windows Vista, Windows 7 SP1, and Windows Media Cmicrosoft · windows media center · CWE-416 pre-auth RCE Memory safety	Medium6.8	—	23.4%	Aug 12, 2014
35Monitor	CVE-2014-4061No exploit	Microsoft SQL Server 2008 SP3, 2008 R2 SP2, and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch commandmicrosoft · sql server · CWE-399 Denial of service	Medium6.8	—	26.4%	Aug 12, 2014
21Monitor	CVE-2014-4062No exploit	Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows rmicrosoft · .net framework · CWE-264 Pre-auth	Medium4.3	—	14.2%	Aug 12, 2014
44Plan	CVE-2014-4063No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	23.4%	Aug 12, 2014
42Plan	CVE-2014-4067No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Aug 12, 2014
34Monitor	CVE-2014-3505No exploit	Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0openssl · openssl Pre-auth Denial of service	Medium5.0	—	46.1%	Aug 13, 2014
34Monitor	CVE-2014-3506No exploit	d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers topenssl · openssl · CWE-399 Pre-auth Denial of service	Medium5.0	—	46.1%	Aug 13, 2014
36Monitor	CVE-2014-3507Proof of concept	Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remopenssl · openssl · CWE-399 Pre-auth Denial of service	Medium5.0	—	54.2%	Aug 13, 2014
24Monitor	CVE-2014-3508No exploit	The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when preopenssl · openssl · CWE-200 Pre-auth Info leak	Medium4.3	—	23.2%	Aug 13, 2014
31Monitor	CVE-2014-3509No exploit	Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithopenssl · openssl · CWE-362 Pre-auth Race condition	Medium6.8	—	13.4%	Aug 13, 2014
22Monitor	CVE-2014-3510No exploit	The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allowsopenssl · openssl Pre-auth Denial of service	Medium4.3	—	17.9%	Aug 13, 2014
21Monitor	CVE-2014-3511No exploit	The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS openssl · openssl Pre-auth	Medium4.3	—	14.1%	Aug 13, 2014
51Plan	CVE-2014-3512No exploit	Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause aopenssl · openssl · CWE-119 Pre-auth Memory safety	High7.5	—	68.9%	Aug 13, 2014
22Monitor	CVE-2014-5139Proof of concept	The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULLopenssl · openssl Pre-auth Denial of service	Medium4.3	—	16.2%	Aug 13, 2014
40Plan	CVE-2012-0938Weaponized	Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to etestlink · testlink · CWE-89 RCE SQL injection	Medium6.5	—	5.8%	Aug 14, 2014
40Plan	CVE-2014-5266Weaponized	The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the numbwordpress · wordpress · CWE-399 Pre-auth Denial of service	Medium5.0	—	24.3%	Aug 18, 2014
39Monitor	CVE-2014-5350Proof of concept	Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files viabitdefender · gravityzone · CWE-22 Pre-auth Path traversal	Medium5.0	—	63.8%	Aug 19, 2014
44Plan	CVE-2014-5210Proof of concept	The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_alienvault · open source security information management · CWE-94 pre-auth RCE	Critical10.0	—	14.9%	Aug 21, 2014
40Plan	CVE-2014-5383Weaponized	SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecialienvault · open source security information management · CWE-89 RCE SQL injection	Medium6.5	—	21.1%	Aug 21, 2014
44Plan	CVE-2014-5246Proof of concept	The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication and gain administratenda · a5s firmware · CWE-264 Pre-auth Auth bypass	Critical10.0	—	12.4%	Aug 22, 2014
33Monitor	CVE-2014-5261No exploit	The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell mcacti · cacti · CWE-94 pre-auth RCE	High7.5	—	10.7%	Aug 22, 2014
26Monitor	CVE-2014-5368Proof of concept	Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-sourcwp content source control project · wp content source control · CWE-22 Pre-auth Path traversal	Medium5.0	—	18.8%	Aug 22, 2014
23Monitor	CVE-2014-3587No exploit	Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.3php · php · CWE-189 Pre-auth Denial of service	Medium4.3	—	20.2%	Aug 22, 2014
32Monitor	CVE-2014-3597No exploit	Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS sephp · php · CWE-119 pre-auth RCE Memory safety	Medium6.8	—	15.4%	Aug 22, 2014
30Monitor	CVE-2014-5120No exploit	gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which migphp · php · CWE-20 Pre-auth	Medium6.4	—	16.9%	Aug 22, 2014
44Plan	CVE-2014-2632No exploit	Unspecified vulnerability in the WebTier component in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to execute arhp · service manager pre-auth RCE	Critical10.0	—	13.3%	Aug 23, 2014
41Plan	CVE-2014-3524No exploit	Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafteapache · openoffice · CWE-77 pre-auth RCE Command injection	Critical9.3	—	14.5%	Aug 26, 2014
20Monitor	CVE-2014-3575No exploit	The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data iapache · openoffice · CWE-200 Pre-auth Info leak	Medium4.3	—	11.3%	Aug 26, 2014
40Plan	CVE-2014-5337Weaponized	The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remowordpress mobile pack project · wordpress mobile pack · CWE-264 Pre-auth	Medium5.0	—	16.9%	Aug 29, 2014
53Plan	CVE-2014-5073Weaponized	vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacvmturbo · operations manager pre-auth RCE	High7.5	—	76.2%	Aug 29, 2014
35Monitor	CVE-2014-5119Proof of concept	Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cgnu · glibc · CWE-189 pre-auth RCE	High7.5	—	16.9%	Aug 29, 2014
63This week	CVE-2013-2597Weaponized	Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used codeaurora · android-msm · CWE-121 Local privilege escalation Memory safety	High8.4	KEV	1.5%	Aug 31, 2014

CVE-2014-0972
28Monitor
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and ot
HighCVSS 7.2No exploitEPSS 0%
codeaurora · android-msmAug 1, 2014
CVE-2014-5160
35Monitor
Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create ar
MediumCVSS 6.4No exploitEPSS 34%
- Pre-auth
- Path traversal
hp · data protectorAug 1, 2014
CVE-2013-5758
40Plan
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system m
CriticalCVSS 9.0Proof of conceptEPSS 11%
- RCE
- Command injection
yealink · sip-t38gAug 3, 2014
CVE-2014-3560
48Plan
NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code v
HighCVSS 7.9No exploitEPSS 56%
- RCE
samba · sambaAug 6, 2014
CVE-2014-3459
30Monitor
Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote attackers to execute arbitrary code vi
MediumCVSS 6.8No exploitEPSS 11%
- pre-auth RCE
- Memory safety
solarwinds · network configuration managerAug 7, 2014
CVE-2014-3914
62This week
Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to
CriticalCVSS 10.0WeaponizedEPSS 72%
- pre-auth RCE
- Path traversal
rocketsoftware · rocket servergraphAug 7, 2014
CVE-2014-2630
40Plan
Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.
MediumCVSS 4.4WeaponizedEPSS 7%
- Local privilege escalation
hp · operations agentAug 12, 2014
CVE-2014-0316
33Monitor
Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Wi
HighCVSS 7.5No exploitEPSS 11%
- Pre-auth
microsoft · windows 7Aug 12, 2014
CVE-2014-0546
76This week
Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, an
CriticalCVSS 9.8KEVWeaponizedEPSS 22%
- Pre-auth
adobe · acrobatAug 12, 2014
CVE-2014-1820
21Monitor
Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows
MediumCVSS 4.3No exploitEPSS 14%
- Pre-auth
- XSS
microsoft · sql serverAug 12, 2014
CVE-2014-2774
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2784
42Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2796
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2808
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2810
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2811
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2815
48Plan
Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executa
HighCVSS 8.8Proof of conceptEPSS 43%
- pre-auth RCE
microsoft · onenoteAug 12, 2014
CVE-2014-2816
42Plan
Microsoft SharePoint Server 2013 Gold and SP1 and SharePoint Foundation 2013 Gold and SP1 allow remote authenticated users to gain privilege
CriticalCVSS 9.3No exploitEPSS 16%
- Pre-auth
microsoft · sharepoint foundationAug 12, 2014
CVE-2014-2817
73This week
Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
HighCVSS 8.8KEVWeaponizedEPSS 26%
- Pre-auth
microsoft · internet explorerAug 12, 2014
CVE-2014-2818
42Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2819
31Monitor
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
MediumCVSS 6.8No exploitEPSS 11%
- Pre-auth
microsoft · internet explorerAug 12, 2014
CVE-2014-2820
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2821
42Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2822
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2823
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2824
42Plan
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2825
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2826
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-2827
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4050
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4051
42Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4052
42Plan
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4055
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4056
42Plan
Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4057
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4058
42Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4060
34Monitor
Use-after-free vulnerability in MCPlayer.dll in Microsoft Windows Media Center TV Pack for Windows Vista, Windows 7 SP1, and Windows Media C
MediumCVSS 6.8No exploitEPSS 23%
- pre-auth RCE
- Memory safety
microsoft · windows media centerAug 12, 2014
CVE-2014-4061
35Monitor
Microsoft SQL Server 2008 SP3, 2008 R2 SP2, and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch command
MediumCVSS 6.8No exploitEPSS 26%
- Denial of service
microsoft · sql serverAug 12, 2014
CVE-2014-4062
21Monitor
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows r
MediumCVSS 4.3No exploitEPSS 14%
- Pre-auth
microsoft · .net frameworkAug 12, 2014
CVE-2014-4063
44Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-4067
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 12, 2014
CVE-2014-3505
34Monitor
Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0
MediumCVSS 5.0No exploitEPSS 46%
- Pre-auth
- Denial of service
openssl · opensslAug 13, 2014
CVE-2014-3506
34Monitor
d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers t
MediumCVSS 5.0No exploitEPSS 46%
- Pre-auth
- Denial of service
openssl · opensslAug 13, 2014
CVE-2014-3507
36Monitor
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows rem
MediumCVSS 5.0Proof of conceptEPSS 54%
- Pre-auth
- Denial of service
openssl · opensslAug 13, 2014
CVE-2014-3508
24Monitor
The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pre
MediumCVSS 4.3No exploitEPSS 23%
- Pre-auth
- Info leak
openssl · opensslAug 13, 2014
CVE-2014-3509
31Monitor
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multith
MediumCVSS 6.8No exploitEPSS 13%
- Pre-auth
- Race condition
openssl · opensslAug 13, 2014
CVE-2014-3510
22Monitor
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows
MediumCVSS 4.3No exploitEPSS 17%
- Pre-auth
- Denial of service
openssl · opensslAug 13, 2014
CVE-2014-3511
21Monitor
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS
MediumCVSS 4.3No exploitEPSS 14%
- Pre-auth
openssl · opensslAug 13, 2014
CVE-2014-3512
51Plan
Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a
HighCVSS 7.5No exploitEPSS 68%
- Pre-auth
- Memory safety
openssl · opensslAug 13, 2014
CVE-2014-5139
22Monitor
The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL
MediumCVSS 4.3Proof of conceptEPSS 16%
- Pre-auth
- Denial of service
openssl · opensslAug 13, 2014
CVE-2012-0938
40Plan
Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to e
MediumCVSS 6.5WeaponizedEPSS 5%
- RCE
- SQL injection
testlink · testlinkAug 14, 2014
CVE-2014-5266
40Plan
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the numb
MediumCVSS 5.0WeaponizedEPSS 24%
- Pre-auth
- Denial of service
wordpress · wordpressAug 18, 2014
CVE-2014-5350
39Monitor
Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via
MediumCVSS 5.0Proof of conceptEPSS 63%
- Pre-auth
- Path traversal
bitdefender · gravityzoneAug 19, 2014
CVE-2014-5210
44Plan
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_
CriticalCVSS 10.0Proof of conceptEPSS 14%
- pre-auth RCE
alienvault · open source security information managementAug 21, 2014
CVE-2014-5383
40Plan
SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspeci
MediumCVSS 6.5WeaponizedEPSS 21%
- RCE
- SQL injection
alienvault · open source security information managementAug 21, 2014
CVE-2014-5246
44Plan
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication and gain administra
CriticalCVSS 10.0Proof of conceptEPSS 12%
- Pre-auth
- Auth bypass
tenda · a5s firmwareAug 22, 2014
CVE-2014-5261
33Monitor
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell m
HighCVSS 7.5No exploitEPSS 10%
- pre-auth RCE
cacti · cactiAug 22, 2014
CVE-2014-5368
26Monitor
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-sourc
MediumCVSS 5.0Proof of conceptEPSS 18%
- Pre-auth
- Path traversal
wp content source control project · wp content source controlAug 22, 2014
CVE-2014-3587
23Monitor
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.3
MediumCVSS 4.3No exploitEPSS 20%
- Pre-auth
- Denial of service
php · phpAug 22, 2014
CVE-2014-3597
32Monitor
Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS se
MediumCVSS 6.8No exploitEPSS 15%
- pre-auth RCE
- Memory safety
php · phpAug 22, 2014
CVE-2014-5120
30Monitor
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which mig
MediumCVSS 6.4No exploitEPSS 16%
- Pre-auth
php · phpAug 22, 2014
CVE-2014-2632
44Plan
Unspecified vulnerability in the WebTier component in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to execute ar
CriticalCVSS 10.0No exploitEPSS 13%
- pre-auth RCE
hp · service managerAug 23, 2014
CVE-2014-3524
41Plan
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafte
CriticalCVSS 9.3No exploitEPSS 14%
- pre-auth RCE
- Command injection
apache · openofficeAug 26, 2014
CVE-2014-3575
20Monitor
The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data i
MediumCVSS 4.3No exploitEPSS 11%
- Pre-auth
- Info leak
apache · openofficeAug 26, 2014
CVE-2014-5337
40Plan
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remo
MediumCVSS 5.0WeaponizedEPSS 16%
- Pre-auth
wordpress mobile pack project · wordpress mobile packAug 29, 2014
CVE-2014-5073
53Plan
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharac
HighCVSS 7.5WeaponizedEPSS 76%
- pre-auth RCE
vmturbo · operations managerAug 29, 2014
CVE-2014-5119
35Monitor
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to c
HighCVSS 7.5Proof of conceptEPSS 16%
- pre-auth RCE
gnu · glibcAug 29, 2014
CVE-2013-2597
63This week
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used
HighCVSS 8.4KEVWeaponizedEPSS 1%
- Local privilege escalation
- Memory safety
codeaurora · android-msmAug 31, 2014