Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2014

66 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2014-7228
    47Plan

    Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla!

    HighCVSS 7.5WeaponizedEPSS 55%

    joomla · joomla\!Nov 3, 2014

  • CVE-2014-8586
    42Plan

    SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL c

    HighCVSS 7.5WeaponizedEPSS 40%

    cp multi view event calendar project · cp multi view event calendarNov 4, 2014

  • CVE-2014-3710
    24Monitor

    The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note

    MediumCVSS 5.0No exploitEPSS 14%

    php · phpNov 5, 2014

  • CVE-2014-0995
    23Monitor

    The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled re

    MediumCVSS 5.0Proof of conceptEPSS 10%

    sap · netweaverNov 6, 2014

  • CVE-2014-8656
    43Plan

    The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    compal broadband networks · firmwareNov 6, 2014

  • CVE-2014-5258
    22Monitor

    Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitr

    MediumCVSS 4.0Proof of conceptEPSS 20%

    webedition · webedition cmsNov 6, 2014

  • CVE-2014-4076
    40Plan

    Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TC

    HighCVSS 7.2WeaponizedEPSS 22%

    microsoft · windows server 2003Nov 11, 2014

  • CVE-2014-4077
    77This week

    Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.E

    HighCVSS 7.8KEVWeaponizedEPSS 54%

    microsoft · office 2007 imeNov 11, 2014

  • CVE-2014-4078
    26Monitor

    The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules

    MediumCVSS 5.1No exploitEPSS 20%

    microsoft · internet information servicesNov 11, 2014

  • CVE-2014-4118
    41Plan

    XML Core Services (aka MSXML) 3.0 in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · windows 7Nov 11, 2014

  • CVE-2014-4143
    43Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-4149
    43Plan

    Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allo

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · .net frameworkNov 11, 2014

  • CVE-2014-6317
    34Monitor

    Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2

    HighCVSS 7.1No exploitEPSS 18%

    microsoft · windows 7Nov 11, 2014

  • CVE-2014-6318
    20Monitor

    The audit logon feature in Remote Desktop Protocol (RDP) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · windows 7Nov 11, 2014

  • CVE-2014-6321
    69This week

    Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,

    CriticalCVSS 10.0No exploitEPSS 95%

    microsoft · windows 7Nov 11, 2014

  • CVE-2014-6322
    21Monitor

    The Windows Audio service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · windows 7Nov 11, 2014

  • CVE-2014-6323
    21Monitor

    Microsoft Internet Explorer 7 through 11 allows remote attackers to obtain sensitive clipboard information via a crafted web site, aka "Inte

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6331
    26Monitor

    Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, do

    MediumCVSS 5.0No exploitEPSS 20%

    microsoft · active directory federation servicesNov 11, 2014

  • CVE-2014-6332
    93Now

    OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, W

    HighCVSS 8.8KEVWeaponizedEPSS 94%

    microsoft · windows 7Nov 11, 2014

  • CVE-2014-6333
    42Plan

    Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Offic

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · office compatibility packNov 11, 2014

  • CVE-2014-6334
    42Plan

    Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o

    CriticalCVSS 9.3No exploitEPSS 17%

    microsoft · office compatibility packNov 11, 2014

  • CVE-2014-6335
    42Plan

    Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · office compatibility packNov 11, 2014

  • CVE-2014-6337
    42Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6339
    24Monitor

    Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Ex

    MediumCVSS 5.0No exploitEPSS 11%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6340
    26Monitor

    Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s

    MediumCVSS 4.3No exploitEPSS 28%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6341
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6342
    42Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6343
    42Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6344
    42Plan

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6345
    26Monitor

    Microsoft Internet Explorer 9 and 10 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site,

    MediumCVSS 4.3No exploitEPSS 30%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6346
    21Monitor

    Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6347
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6348
    42Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6349
    20Monitor

    Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6350
    23Monitor

    Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of

    MediumCVSS 4.3No exploitEPSS 20%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6351
    44Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-6353
    42Plan

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerNov 11, 2014

  • CVE-2014-0582
    43Plan

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.2

    CriticalCVSS 10.0No exploitEPSS 11%

    adobe · flash playerNov 11, 2014

  • CVE-2014-8440
    65This week

    Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef

    CriticalCVSS 10.0WeaponizedEPSS 81%

    adobe · flash playerNov 11, 2014

  • CVE-2014-1635
    60This week

    Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute

    CriticalCVSS 10.0WeaponizedEPSS 67%

    belkin · n750 wireless router firmwareNov 12, 2014

  • CVE-2014-5424
    33Monitor

    Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application cr

    HighCVSS 7.5No exploitEPSS 11%

    rockwellautomation · connected components workbenchNov 13, 2014

  • CVE-2014-7878
    43Plan

    The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node im

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · helion cloud development platformNov 13, 2014

  • CVE-2014-2268
    40Plan

    views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers

    MediumCVSS 5.0WeaponizedEPSS 31%

    vtiger · vtiger crmNov 15, 2014

  • CVE-2014-8498
    30Monitor

    SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service P

    MediumCVSS 6.5Proof of conceptEPSS 12%

    zohocorp · manageengine password manager proNov 17, 2014

  • CVE-2014-8499
    40Plan

    Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) e

    MediumCVSS 6.5WeaponizedEPSS 36%

    manageengine · password manager proNov 17, 2014

  • CVE-2014-8517
    51Plan

    The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 t

    HighCVSS 7.5WeaponizedEPSS 69%

    netbsd · netbsdNov 17, 2014

  • CVE-2014-7992
    40Plan

    The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential inform

    MediumCVSS 5.0WeaponizedEPSS 27%

    cisco · iosNov 17, 2014

  • CVE-2014-7146
    45Plan

    The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) descriptio

    HighCVSS 7.5WeaponizedEPSS 50%

    mantisbt · mantisbtNov 18, 2014

  • CVE-2014-8598
    40Plan

    The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via

    MediumCVSS 6.4WeaponizedEPSS 38%

    mantisbt · mantisbtNov 18, 2014

  • CVE-2014-6324
    91Now

    The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wind

    HighCVSS 8.8KEVWeaponizedEPSS 87%

    microsoft · windows 7Nov 18, 2014

  • CVE-2014-8387
    45Plan

    cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell

    CriticalCVSS 9.0Proof of conceptEPSS 30%

    advantech · eki-6340 firmwareNov 20, 2014

  • CVE-2014-8998
    40Plan

    lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header t

    MediumCVSS 6.5WeaponizedEPSS 35%

    x7chat · x7 chatNov 20, 2014

  • CVE-2014-3625
    23Monitor

    Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2

    MediumCVSS 5.0Proof of conceptEPSS 10%

    pivotal software · spring frameworkNov 20, 2014

  • CVE-2014-8768
    26Monitor

    Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cau

    MediumCVSS 5.0Proof of conceptEPSS 19%

    opensuse · opensuseNov 20, 2014

  • CVE-2014-8682
    40Plan

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to e

    HighCVSS 7.5Proof of conceptEPSS 33%

    gogits · gogsNov 21, 2014

  • CVE-2014-9016
    45Plan

    The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allo

    MediumCVSS 5.0WeaponizedEPSS 82%

    drupal · drupalNov 24, 2014

  • CVE-2010-5312
    30Monitor

    Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to i

    MediumCVSS 6.1No exploitEPSS 18%

    debian · debian linuxNov 24, 2014

  • CVE-2014-8420
    43Plan

    The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicW

    CriticalCVSS 9.0WeaponizedEPSS 23%

    sonicwall · analyzerNov 25, 2014

  • CVE-2014-8439
    71This week

    Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR bef

    HighCVSS 8.8KEVWeaponizedEPSS 20%

    adobe · flash playerNov 25, 2014

  • CVE-2014-9034
    45Plan

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers

    MediumCVSS 5.0Proof of conceptEPSS 82%

    wordpress · wordpressNov 25, 2014

  • CVE-2014-7141
    48Plan

    The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds rea

    MediumCVSS 6.4No exploitEPSS 76%

    squid-cache · squidNov 26, 2014

  • CVE-2014-7142
    32Monitor

    The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a craf

    MediumCVSS 6.4No exploitEPSS 24%

    oracle · solarisNov 26, 2014

  • CVE-2014-8423
    59Plan

    Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via

    CriticalCVSS 10.0WeaponizedEPSS 62%

    arris · vap2500 firmwareNov 28, 2014

  • CVE-2014-8424
    49Plan

    ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

    HighCVSS 7.8WeaponizedEPSS 59%

    arris · vap2500 firmwareNov 28, 2014

  • CVE-2014-8799
    41Plan

    Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress a

    MediumCVSS 5.0WeaponizedEPSS 68%

    dukapress · dukapressNov 28, 2014

  • CVE-2014-8801
    25Monitor

    Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attac

    MediumCVSS 5.0Proof of conceptEPSS 18%

    strangerstudios · paid memberships proNov 28, 2014