By publication date

Exploited and new serious CVEs: September 2014

70 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2014-6041Weaponized	The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u00google · android browser · CWE-264 Pre-auth	Medium5.8	—	18.2%	Sep 2, 2014
24Monitor	CVE-2014-5465Proof of concept	Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attacwerdswords · download shortcode · CWE-22 Pre-auth Path traversal	Medium5.0	—	13.5%	Sep 3, 2014
20Monitor	CVE-2012-4768Proof of concept	Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitmikejolley · download monitor · CWE-79 Pre-auth XSS	Medium4.3	—	10.4%	Sep 4, 2014
31Monitor	CVE-2014-2685No exploit	The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 beforezend · zend framework · CWE-287 Pre-auth Auth bypass	High7.5	—	2.8%	Sep 4, 2014
21Monitor	CVE-2014-3529No exploit	The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML externalapache · poi Pre-auth XXE	Medium4.3	—	12.7%	Sep 4, 2014
40Plan	CVE-2014-5377Weaponized	ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials viamanageengine · device expert · CWE-200 Pre-auth Info leak	Medium5.0	—	57.4%	Sep 4, 2014
24Monitor	CVE-2014-5461No exploit	Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial lua · lua · CWE-119 Pre-auth Memory safety Denial of service	Medium5.0	—	12.0%	Sep 4, 2014
25Monitor	CVE-2014-4862No exploit	The Netmaster CBW700N cable modem with software 81.447.392110.729.024 has an SNMP community of public, which allows remote attackers to obtanetmaster · cbw700 software · CWE-200 Pre-auth Info leak	Medium5.0	—	17.1%	Sep 5, 2014
40Plan	CVE-2014-4863Weaponized	The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote attackers to obtain sensarris · touchstone dg950a software · CWE-200 Pre-auth Info leak	Medium5.0	—	15.7%	Sep 5, 2014
65This week	CVE-2014-0556Weaponized	Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.2adobe · flash player · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	84.5%	Sep 9, 2014
44Plan	CVE-2014-0559No exploit	Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.2adobe · adobe air · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	13.3%	Sep 9, 2014
42Plan	CVE-2014-2799No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
42Plan	CVE-2014-4059No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4065No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
26Monitor	CVE-2014-4068No exploit	The Response Group Service in Microsoft Lync Server 2010 and 2013 and the Core Components in Lync Server 2013 do not properly handle exceptimicrosoft · lync server · CWE-20 Pre-auth Denial of service	Medium5.0	—	19.6%	Sep 9, 2014
20Monitor	CVE-2014-4070No exploit	Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitrmicrosoft · lync server · CWE-79 Pre-auth XSS	Medium4.3	—	10.9%	Sep 9, 2014
26Monitor	CVE-2014-4071No exploit	The Server in Microsoft Lync Server 2013 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon hang) viamicrosoft · lync server Pre-auth Denial of service	Medium5.0	—	18.9%	Sep 9, 2014
29Monitor	CVE-2014-4072No exploit	Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly use a hash table for request datamicrosoft · .net framework · CWE-399 Pre-auth Denial of service	Medium5.0	—	30.9%	Sep 9, 2014
42Plan	CVE-2014-4079No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
45Plan	CVE-2014-4080No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.5%	Sep 9, 2014
45Plan	CVE-2014-4081No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.5%	Sep 9, 2014
42Plan	CVE-2014-4082No exploit	Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.3%	Sep 9, 2014
42Plan	CVE-2014-4083No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
44Plan	CVE-2014-4084No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	23.4%	Sep 9, 2014
42Plan	CVE-2014-4085No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4086No exploit	Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.3%	Sep 9, 2014
42Plan	CVE-2014-4087No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4088No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
44Plan	CVE-2014-4089No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	22.7%	Sep 9, 2014
42Plan	CVE-2014-4090No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4091No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4092No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4093No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.3%	Sep 9, 2014
44Plan	CVE-2014-4094No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	22.7%	Sep 9, 2014
42Plan	CVE-2014-4095No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4096No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4097No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4098No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4099No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4100No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
43Plan	CVE-2014-4101No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.5%	Sep 9, 2014
42Plan	CVE-2014-4102No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4103No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4104No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.9%	Sep 9, 2014
42Plan	CVE-2014-4105No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
42Plan	CVE-2014-4106No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
42Plan	CVE-2014-4107No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
42Plan	CVE-2014-4108No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
46Plan	CVE-2014-4109Proof of concept	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	31.2%	Sep 9, 2014
42Plan	CVE-2014-4110No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
42Plan	CVE-2014-4111No exploit	Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.1%	Sep 9, 2014
60This week	CVE-2014-2624Weaponized	Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unkhp · network node manager i pre-auth RCE	Critical10.0	—	65.4%	Sep 10, 2014
33Monitor	CVE-2014-2223Proof of concept	Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to exeplogger · plogger · CWE-94 pre-auth RCE File upload	High7.5	—	10.0%	Sep 11, 2014
49Plan	CVE-2014-5519Weaponized	The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edphpwiki project · phpwiki · CWE-94 pre-auth RCE	High7.5	—	64.9%	Sep 11, 2014
47Plan	CVE-2014-5460Weaponized	Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated usertribulant · tibulant slideshow gallery · CWE-20 RCE File upload	Medium6.5	—	70.8%	Sep 11, 2014
30Monitor	CVE-2014-6043Proof of concept	ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allowzohocorp · manageengine eventlog analyzer · CWE-264	Medium6.5	—	12.7%	Sep 11, 2014
37Monitor	CVE-2014-3609No exploit	HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a requestsquid-cache · squid · CWE-20 Pre-auth Denial of service	Medium5.0	—	56.2%	Sep 11, 2014
31Monitor	CVE-2013-4444No exploit	Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a apache · tomcat · CWE-94 pre-auth RCE File upload	Medium6.8	—	13.9%	Sep 12, 2014
34Monitor	CVE-2014-6270No exploit	Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackersquid-cache · squid · CWE-119 pre-auth RCE Memory safety	Medium6.8	—	23.3%	Sep 12, 2014
76This week	CVE-2014-4404Weaponized	Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privilapple · iphone os · CWE-787 RCE Local privilege escalation Memory safety	High7.8	KEV	48.9%	Sep 18, 2014
42Plan	CVE-2006-1318No exploit	Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lemicrosoft · office · CWE-94 pre-auth RCE	Critical9.3	—	15.4%	Sep 19, 2014
99Now	CVE-2014-6271Weaponized	GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attacgnu · bash · CWE-78 pre-auth RCE Command injection	Critical9.8	KEV	99.9%	Sep 24, 2014
99Now	CVE-2014-7169Weaponized	GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variablgnu · bash · CWE-78 pre-auth RCE Command injection	Critical9.8	KEV	99.9%	Sep 24, 2014
35Monitor	CVE-2014-1568No exploit	Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 3mozilla · firefox · CWE-310 Pre-auth	High7.5	—	16.7%	Sep 25, 2014
44Plan	CVE-2014-6446Weaponized	The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers toinfusionsoft gravity forms project · infusionsoft gravity forms · CWE-94 pre-auth RCE	High7.5	—	46.1%	Sep 26, 2014
59Plan	CVE-2014-6277Proof of concept	GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attgnu · bash · CWE-78 pre-auth RCE Command injection	Critical10.0	—	64.3%	Sep 27, 2014
59Plan	CVE-2014-7186Proof of concept	The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bognu · bash · CWE-119 Pre-auth Memory safety	Critical10.0	—	64.3%	Sep 28, 2014
58Plan	CVE-2014-7187Proof of concept	Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of gnu · bash · CWE-119 Pre-auth Memory safety	Critical10.0	—	60.2%	Sep 28, 2014
52Plan	CVE-2013-3632Weaponized	The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitraropenmediavault · openmediavault · CWE-264 RCE	High8.8	—	57.1%	Sep 29, 2014
95Now	CVE-2014-6278Weaponized	GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attgnu · bash · CWE-78 pre-auth RCE Command injection	High8.8	KEV	99.5%	Sep 30, 2014

CVE-2014-6041
40Plan
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u00
MediumCVSS 5.8WeaponizedEPSS 18%
- Pre-auth
google · android browserSep 2, 2014
CVE-2014-5465
24Monitor
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attac
MediumCVSS 5.0Proof of conceptEPSS 13%
- Pre-auth
- Path traversal
werdswords · download shortcodeSep 3, 2014
CVE-2012-4768
20Monitor
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbit
MediumCVSS 4.3Proof of conceptEPSS 10%
- Pre-auth
- XSS
mikejolley · download monitorSep 4, 2014
CVE-2014-2685
31Monitor
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- Auth bypass
zend · zend frameworkSep 4, 2014
CVE-2014-3529
21Monitor
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external
MediumCVSS 4.3No exploitEPSS 12%
- Pre-auth
- XXE
apache · poiSep 4, 2014
CVE-2014-5377
40Plan
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via
MediumCVSS 5.0WeaponizedEPSS 57%
- Pre-auth
- Info leak
manageengine · device expertSep 4, 2014
CVE-2014-5461
24Monitor
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial
MediumCVSS 5.0No exploitEPSS 12%
- Pre-auth
- Memory safety
- Denial of service
lua · luaSep 4, 2014
CVE-2014-4862
25Monitor
The Netmaster CBW700N cable modem with software 81.447.392110.729.024 has an SNMP community of public, which allows remote attackers to obta
MediumCVSS 5.0No exploitEPSS 17%
- Pre-auth
- Info leak
netmaster · cbw700 softwareSep 5, 2014
CVE-2014-4863
40Plan
The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote attackers to obtain sens
MediumCVSS 5.0WeaponizedEPSS 15%
- Pre-auth
- Info leak
arris · touchstone dg950a softwareSep 5, 2014
CVE-2014-0556
65This week
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.2
CriticalCVSS 10.0WeaponizedEPSS 84%
- pre-auth RCE
- Memory safety
adobe · flash playerSep 9, 2014
CVE-2014-0559
44Plan
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.2
CriticalCVSS 10.0No exploitEPSS 13%
- pre-auth RCE
- Memory safety
adobe · adobe airSep 9, 2014
CVE-2014-2799
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4059
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4065
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4068
26Monitor
The Response Group Service in Microsoft Lync Server 2010 and 2013 and the Core Components in Lync Server 2013 do not properly handle excepti
MediumCVSS 5.0No exploitEPSS 19%
- Pre-auth
- Denial of service
microsoft · lync serverSep 9, 2014
CVE-2014-4070
20Monitor
Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitr
MediumCVSS 4.3No exploitEPSS 10%
- Pre-auth
- XSS
microsoft · lync serverSep 9, 2014
CVE-2014-4071
26Monitor
The Server in Microsoft Lync Server 2013 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon hang) via
MediumCVSS 5.0No exploitEPSS 18%
- Pre-auth
- Denial of service
microsoft · lync serverSep 9, 2014
CVE-2014-4072
29Monitor
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly use a hash table for request data
MediumCVSS 5.0No exploitEPSS 30%
- Pre-auth
- Denial of service
microsoft · .net frameworkSep 9, 2014
CVE-2014-4079
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4080
45Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4081
45Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4082
42Plan
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4083
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4084
44Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4085
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4086
42Plan
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4087
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4088
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4089
44Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4090
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4091
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4092
42Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4093
42Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4094
44Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4095
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4096
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4097
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4098
42Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4099
42Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4100
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4101
43Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4102
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4103
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4104
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4105
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4106
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4107
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4108
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4109
46Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3Proof of conceptEPSS 31%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4110
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-4111
42Plan
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerSep 9, 2014
CVE-2014-2624
60This week
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unk
CriticalCVSS 10.0WeaponizedEPSS 65%
- pre-auth RCE
hp · network node manager iSep 10, 2014
CVE-2014-2223
33Monitor
Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to exe
HighCVSS 7.5Proof of conceptEPSS 10%
- pre-auth RCE
- File upload
plogger · ploggerSep 11, 2014
CVE-2014-5519
49Plan
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the ed
HighCVSS 7.5WeaponizedEPSS 64%
- pre-auth RCE
phpwiki project · phpwikiSep 11, 2014
CVE-2014-5460
47Plan
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated user
MediumCVSS 6.5WeaponizedEPSS 70%
- RCE
- File upload
tribulant · tibulant slideshow gallerySep 11, 2014
CVE-2014-6043
30Monitor
ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allow
MediumCVSS 6.5Proof of conceptEPSS 12%
zohocorp · manageengine eventlog analyzerSep 11, 2014
CVE-2014-3609
37Monitor
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request
MediumCVSS 5.0No exploitEPSS 56%
- Pre-auth
- Denial of service
squid-cache · squidSep 11, 2014
CVE-2013-4444
31Monitor
Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a
MediumCVSS 6.8No exploitEPSS 13%
- pre-auth RCE
- File upload
apache · tomcatSep 12, 2014
CVE-2014-6270
34Monitor
Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attacker
MediumCVSS 6.8No exploitEPSS 23%
- pre-auth RCE
- Memory safety
squid-cache · squidSep 12, 2014
CVE-2014-4404
76This week
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privil
HighCVSS 7.8KEVWeaponizedEPSS 48%
- RCE
- Local privilege escalation
- Memory safety
apple · iphone osSep 18, 2014
CVE-2006-1318
42Plan
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record le
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · officeSep 19, 2014
CVE-2014-6271
99Now
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- Command injection
gnu · bashSep 24, 2014
CVE-2014-7169
99Now
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variabl
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- Command injection
gnu · bashSep 24, 2014
CVE-2014-1568
35Monitor
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 3
HighCVSS 7.5No exploitEPSS 16%
- Pre-auth
mozilla · firefoxSep 25, 2014
CVE-2014-6446
44Plan
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to
HighCVSS 7.5WeaponizedEPSS 46%
- pre-auth RCE
infusionsoft gravity forms project · infusionsoft gravity formsSep 26, 2014
CVE-2014-6277
59Plan
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att
CriticalCVSS 10.0Proof of conceptEPSS 64%
- pre-auth RCE
- Command injection
gnu · bashSep 27, 2014
CVE-2014-7186
59Plan
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bo
CriticalCVSS 10.0Proof of conceptEPSS 64%
- Pre-auth
- Memory safety
gnu · bashSep 28, 2014
CVE-2014-7187
58Plan
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of
CriticalCVSS 10.0Proof of conceptEPSS 60%
- Pre-auth
- Memory safety
gnu · bashSep 28, 2014
CVE-2013-3632
52Plan
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrar
HighCVSS 8.8WeaponizedEPSS 57%
- RCE
openmediavault · openmediavaultSep 29, 2014
CVE-2014-6278
95Now
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att
HighCVSS 8.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- Command injection
gnu · bashSep 30, 2014