Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2014

51 records · 6 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2014-2044
    34Monitor

    Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to

    HighCVSS 7.5Proof of conceptEPSS 12%

    owncloud · owncloudOct 6, 2014

  • CVE-2014-6287
    99Now

    The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attacke

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    rejetto · http file serverOct 7, 2014

  • CVE-2014-7235
    53Plan

    htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 bef

    CriticalCVSS 10.0Proof of conceptEPSS 43%

    freepbx · freepbxOct 7, 2014

  • CVE-2014-7205
    64This week

    Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server frame

    CriticalCVSS 10.0WeaponizedEPSS 78%

    bassmaster project · bassmasterOct 8, 2014

  • CVE-2014-7981
    40Plan

    SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspec

    HighCVSS 7.5WeaponizedEPSS 8%

    joomla · joomla\!Oct 8, 2014

  • CVE-2014-3581
    24Monitor

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows re

    MediumCVSS 5.0No exploitEPSS 13%

    apache · http serverOct 10, 2014

  • CVE-2014-4872
    54Plan

    BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute

    HighCVSS 7.5WeaponizedEPSS 79%

    bmc · track-it\!Oct 10, 2014

  • CVE-2014-3566
    60This week

    The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man

    LowCVSS 3.4WeaponizedEPSS 99%

    openssl · opensslOct 14, 2014

  • CVE-2014-0569
    64This week

    Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on

    CriticalCVSS 9.3WeaponizedEPSS 91%

    adobe · flash playerOct 15, 2014

  • CVE-2014-4073
    47Plan

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce insta

    CriticalCVSS 10.0No exploitEPSS 23%

    microsoft · .net frameworkOct 15, 2014

  • CVE-2014-4075
    23Monitor

    Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remot

    MediumCVSS 4.3No exploitEPSS 20%

    microsoft · asp.net model view controllerOct 15, 2014

  • CVE-2014-4113
    87Now

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7

    HighCVSS 7.8KEVWeaponizedEPSS 86%

    microsoft · windows 7Oct 15, 2014

  • CVE-2014-4114
    85Now

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and

    HighCVSS 7.8KEVWeaponizedEPSS 81%

    microsoft · windows 7Oct 15, 2014

  • CVE-2014-4117
    42Plan

    Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · officeOct 15, 2014

  • CVE-2014-4121
    46Plan

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized resource identifiers, which

    CriticalCVSS 10.0No exploitEPSS 19%

    microsoft · .net frameworkOct 15, 2014

  • CVE-2014-4122
    21Monitor

    Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 omits the ASLR protection mechanism, which allows remote attackers to obtain potentially se

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · .net frameworkOct 15, 2014

  • CVE-2014-4123
    79This week

    Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation

    HighCVSS 8.8KEVWeaponizedEPSS 47%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4124
    30Monitor

    Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation

    MediumCVSS 6.8No exploitEPSS 11%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4126
    43Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4127
    42Plan

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4128
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4129
    44Plan

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4130
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4132
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4133
    42Plan

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4134
    42Plan

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4137
    44Plan

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4138
    47Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3Proof of conceptEPSS 32%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4140
    23Monitor

    Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern

    MediumCVSS 4.3Proof of conceptEPSS 20%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4141
    46Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3Proof of conceptEPSS 30%

    microsoft · internet explorerOct 15, 2014

  • CVE-2014-4148
    83Now

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7

    HighCVSS 8.8KEVWeaponizedEPSS 59%

    microsoft · windows 7Oct 15, 2014

  • CVE-2014-4278
    33Monitor

    Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, a

    HighCVSS 7.5No exploitEPSS 10%

    oracle · e-business suiteOct 15, 2014

  • CVE-2014-3704
    60This week

    The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements,

    HighCVSS 7.5WeaponizedEPSS 99%

    drupal · drupalOct 15, 2014

  • CVE-2014-7237
    33Monitor

    lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and

    MediumCVSS 6.8No exploitEPSS 20%

    twiki · twikiOct 15, 2014

  • CVE-2014-3513
    39Monitor

    Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (mem

    HighCVSS 7.1No exploitEPSS 37%

    openssl · opensslOct 18, 2014

  • CVE-2014-3567
    35Monitor

    Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows re

    HighCVSS 7.1No exploitEPSS 22%

    openssl · opensslOct 18, 2014

  • CVE-2014-3568
    21Monitor

    OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote

    MediumCVSS 4.3No exploitEPSS 13%

    openssl · opensslOct 18, 2014

  • CVE-2014-6308
    27Monitor

    Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a ..

    MediumCVSS 5.0Proof of conceptEPSS 22%

    osclass · osclassOct 20, 2014

  • CVE-2014-7140
    35Monitor

    Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x b

    HighCVSS 7.5Proof of conceptEPSS 16%

    citrix · netscaler application delivery controller firmwareOct 21, 2014

  • CVE-2014-5005
    53Plan

    Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar

    HighCVSS 7.5WeaponizedEPSS 77%

    zohocorp · manageengine desktop centralOct 21, 2014

  • CVE-2014-5006
    38Monitor

    Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar

    HighCVSS 7.5Proof of conceptEPSS 25%

    zohocorp · manageengine desktop centralOct 21, 2014

  • CVE-2014-6352
    84Now

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and

    HighCVSS 7.8KEVWeaponizedEPSS 77%

    microsoft · windows 7Oct 22, 2014

  • CVE-2014-3828
    62This week

    Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attac

    CriticalCVSS 10.0WeaponizedEPSS 72%

    merethis · centreonOct 22, 2014

  • CVE-2014-3829
    64This week

    displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execu

    CriticalCVSS 10.0WeaponizedEPSS 80%

    merethis · centreonOct 22, 2014

  • CVE-2014-0476
    40Plan

    The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a

    LowCVSS 3.7WeaponizedEPSS 3%

    chkrootkit · chkrootkitOct 25, 2014

  • CVE-2014-6037
    55Plan

    Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows

    HighCVSS 7.5WeaponizedEPSS 84%

    zohocorp · manageengine eventlog analyzerOct 26, 2014

  • CVE-2014-3668
    28Monitor

    Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before

    MediumCVSS 5.0No exploitEPSS 27%

    php · phpOct 29, 2014

  • CVE-2014-3669
    39Monitor

    Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x befor

    HighCVSS 7.5No exploitEPSS 28%

    php · phpOct 29, 2014

  • CVE-2014-3670
    34Monitor

    The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates

    MediumCVSS 6.8No exploitEPSS 22%

    php · phpOct 29, 2014

  • CVE-2014-4877
    49Plan

    Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary fi

    CriticalCVSS 9.3WeaponizedEPSS 39%

    gnu · wgetOct 29, 2014

  • CVE-2013-7409
    50Plan

    Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary

    HighCVSS 7.5WeaponizedEPSS 67%

    allplayer · allplayerOct 30, 2014