Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2014

72 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2014-7816
    40Plan

    Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running

    MediumCVSS 5.0WeaponizedEPSS 25%

    redhat · undertowDec 1, 2014

  • CVE-2014-8791
    40Plan

    project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP

    MediumCVSS 6.0WeaponizedEPSS 14%

    enalean · tuleapDec 1, 2014

  • CVE-2014-5445
    49Plan

    Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attacker

    MediumCVSS 5.0WeaponizedEPSS 98%

    zohocorp · manageengine it360Dec 4, 2014

  • CVE-2014-5446
    36Monitor

    Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow

    MediumCVSS 5.0Proof of conceptEPSS 54%

    zohocorp · manageengine it360Dec 4, 2014

  • CVE-2014-6034
    44Plan

    Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpM

    MediumCVSS 5.0WeaponizedEPSS 78%

    zohocorp · manageengine social it plusDec 4, 2014

  • CVE-2014-6035
    39Monitor

    Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attacker

    HighCVSS 7.5Proof of conceptEPSS 28%

    zohocorp · manageengine opmanagerDec 4, 2014

  • CVE-2014-6036
    36Monitor

    Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and

    MediumCVSS 6.4Proof of conceptEPSS 36%

    zohocorp · manageengine opmanagerDec 4, 2014

  • CVE-2014-7867
    42Plan

    SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 a

    HighCVSS 7.5No exploitEPSS 39%

    zohocorp · manageengine opmanagerDec 4, 2014

  • CVE-2014-7868
    52Plan

    Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remo

    HighCVSS 7.5Proof of conceptEPSS 73%

    zohocorp · manageengine social it plusDec 4, 2014

  • CVE-2014-3996
    42Plan

    SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Pro

    HighCVSS 7.5WeaponizedEPSS 38%

    manageengine · it360Dec 5, 2014

  • CVE-2014-3997
    34Monitor

    SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi

    HighCVSS 7.5Proof of conceptEPSS 13%

    zohocorp · manageengine password manager proDec 5, 2014

  • CVE-2014-8877
    44Plan

    The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    creative minds · cm download managerDec 5, 2014

  • CVE-2014-4880
    51Plan

    Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arb

    HighCVSS 7.5WeaponizedEPSS 70%

    hikvision · dvr ds-7204 firmwareDec 8, 2014

  • CVE-2014-9218
    23Monitor

    libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to ca

    MediumCVSS 5.0Proof of conceptEPSS 11%

    phpmyadmin · phpmyadminDec 8, 2014

  • CVE-2014-9029
    35Monitor

    Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and e

    HighCVSS 7.5No exploitEPSS 18%

    jasper project · jasperDec 8, 2014

  • CVE-2014-9130
    24Monitor

    scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause

    MediumCVSS 5.0No exploitEPSS 13%

    pyyaml · libyamlDec 8, 2014

  • CVE-2014-8730
    21Monitor

    The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11

    MediumCVSS 4.3No exploitEPSS 13%

    f5 · big-ip local traffic managerDec 9, 2014

  • CVE-2014-8601
    41Plan

    PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance

    MediumCVSS 5.0No exploitEPSS 68%

    powerdns · recursorDec 10, 2014

  • CVE-2014-7866
    54Plan

    Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT

    HighCVSS 7.5Proof of conceptEPSS 79%

    zohocorp · manageengine social it plusDec 10, 2014

  • CVE-2014-8449
    44Plan

    Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arb

    CriticalCVSS 10.0No exploitEPSS 14%

    adobe · acrobat readerDec 10, 2014

  • CVE-2014-8452
    25Monitor

    Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to read arbitrary files via

    MediumCVSS 5.0No exploitEPSS 17%

    adobe · acrobat readerDec 10, 2014

  • CVE-2014-8453
    24Monitor

    Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to bypass the Same Origin Po

    MediumCVSS 5.0No exploitEPSS 12%

    adobe · acrobatDec 10, 2014

  • CVE-2014-8457
    44Plan

    Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to e

    CriticalCVSS 10.0No exploitEPSS 12%

    adobe · acrobatDec 10, 2014

  • CVE-2014-9163
    67This week

    Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.

    HighCVSS 7.8KEVWeaponizedEPSS 20%

    adobe · flash playerDec 10, 2014

  • CVE-2014-6327
    41Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6328
    26Monitor

    Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d

    MediumCVSS 5.0No exploitEPSS 21%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6329
    43Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6330
    44Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6355
    30Monitor

    The Graphics Component in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8

    MediumCVSS 5.0No exploitEPSS 34%

    microsoft · windows 7Dec 10, 2014

  • CVE-2014-6356
    41Plan

    Array index error in Microsoft Word 2007 SP3, Word 2010 SP2, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary

    CriticalCVSS 9.3No exploitEPSS 11%

    microsoft · office compatibility packDec 10, 2014

  • CVE-2014-6357
    43Plan

    Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and SP1, Office 2013 RT Gold and SP1, Office for Mac 2011, Word

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · officeDec 10, 2014

  • CVE-2014-6360
    41Plan

    Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack allow remote attackers to execute arbitrary code via a crafted Offic

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · excelDec 10, 2014

  • CVE-2014-6361
    41Plan

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 Gold and SP1, Excel 2013 RT Gold and SP1, and Office Compatibility Pack allow remote at

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · excelDec 10, 2014

  • CVE-2014-6363
    46Plan

    vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers

    CriticalCVSS 9.3Proof of conceptEPSS 28%

    microsoft · vbscriptDec 10, 2014

  • CVE-2014-6364
    41Plan

    Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, and SP2; and 2013 RT Gold and SP1 allows remote attacke

    CriticalCVSS 9.3No exploitEPSS 14%

    microsoft · officeDec 10, 2014

  • CVE-2014-6365
    24Monitor

    Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d

    MediumCVSS 4.3No exploitEPSS 24%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6366
    44Plan

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6368
    21Monitor

    Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explore

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6369
    44Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6373
    41Plan

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6374
    41Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6375
    41Plan

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-6376
    41Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-8966
    41Plan

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · internet explorerDec 10, 2014

  • CVE-2014-8500
    48Plan

    ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attacke

    HighCVSS 7.8No exploitEPSS 57%

    isc · bindDec 10, 2014

  • CVE-2014-8602
    27Monitor

    iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service

    MediumCVSS 4.3No exploitEPSS 32%

    nlnetlabs · unboundDec 10, 2014

  • CVE-2014-7192
    44Plan

    Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application De

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    joyent · node.jsDec 11, 2014

  • CVE-2014-8270
    40Plan

    BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a

    MediumCVSS 5.0WeaponizedEPSS 19%

    bmc · track-it\!Dec 12, 2014

  • CVE-2014-3583
    23Monitor

    The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers

    MediumCVSS 5.0No exploitEPSS 10%

    apache · http serverDec 15, 2014

  • CVE-2014-6261
    43Plan

    Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary c

    CriticalCVSS 9.3No exploitEPSS 19%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-7911
    35Monitor

    luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify th

    HighCVSS 7.2Proof of conceptEPSS 23%

    google · androidDec 15, 2014

  • CVE-2014-8967
    31Monitor

    Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted HTML document in

    MediumCVSS 6.8No exploitEPSS 12%

    microsoft · internet explorerDec 15, 2014

  • CVE-2014-4936
    42Plan

    The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.101

    CriticalCVSS 9.3WeaponizedEPSS 16%

    malwarebytes · malwarebytes anti-exploitDec 16, 2014

  • CVE-2014-9371
    46Plan

    The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON o

    CriticalCVSS 10.0No exploitEPSS 19%

    zohocorp · manageengine desktop centralDec 16, 2014

  • CVE-2014-7285
    41Plan

    The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS co

    MediumCVSS 6.5WeaponizedEPSS 50%

    symantec · web gatewayDec 17, 2014

  • CVE-2014-3580
    23Monitor

    The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a

    MediumCVSS 5.0No exploitEPSS 11%

    apache · subversionDec 18, 2014

  • CVE-2014-8108
    23Monitor

    The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause

    MediumCVSS 5.0No exploitEPSS 10%

    apache · subversionDec 18, 2014

  • CVE-2014-8272
    26Monitor

    The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly se

    MediumCVSS 5.0Proof of conceptEPSS 19%

    dell · idrac6 modularDec 19, 2014

  • CVE-2014-6395
    34Monitor

    Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attacke

    HighCVSS 7.5Proof of conceptEPSS 12%

    ettercap-project · ettercapDec 19, 2014

  • CVE-2014-9293
    34Monitor

    The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easi

    HighCVSS 7.5No exploitEPSS 12%

    ntp · ntpDec 19, 2014

  • CVE-2014-9294
    34Monitor

    util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptogra

    HighCVSS 7.5No exploitEPSS 12%

    ntp · ntpDec 19, 2014

  • CVE-2014-9295
    54Plan

    Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, rel

    HighCVSS 7.5Proof of conceptEPSS 79%

    ntp · ntpDec 19, 2014

  • CVE-2014-9296
    25Monitor

    The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which m

    MediumCVSS 5.0No exploitEPSS 16%

    ntp · ntpDec 19, 2014

  • CVE-2014-8142
    46Plan

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.

    HighCVSS 7.5Proof of conceptEPSS 53%

    php · phpDec 20, 2014

  • CVE-2014-5208
    40Plan

    BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5

    HighCVSS 7.5WeaponizedEPSS 22%

    yokogawa · exaopcDec 22, 2014

  • CVE-2014-3569
    26Monitor

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupporte

    MediumCVSS 5.0No exploitEPSS 19%

    openssl · opensslDec 24, 2014

  • CVE-2014-8137
    31Monitor

    Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of

    MediumCVSS 6.8No exploitEPSS 14%

    jasper project · jasperDec 24, 2014

  • CVE-2014-8138
    36Monitor

    Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cr

    HighCVSS 7.5No exploitEPSS 18%

    redhat · enterprise linuxDec 24, 2014

  • CVE-2014-9222
    59Plan

    AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to ga

    CriticalCVSS 10.0WeaponizedEPSS 63%

    allegrosoft · rompagerDec 24, 2014

  • CVE-2011-4722
    48Plan

    Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a

    HighCVSS 7.8WeaponizedEPSS 58%

    ipswitch · tftp serverDec 27, 2014

  • CVE-2014-8109
    24Monitor

    mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which th

    MediumCVSS 4.3No exploitEPSS 22%

    apache · http serverDec 29, 2014

  • CVE-2014-9119
    25Monitor

    Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbi

    MediumCVSS 5.0Proof of conceptEPSS 15%

    db backup project · db backupDec 31, 2014