Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2015

43 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2014-9456
    43Plan

    Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XM

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    don ho · notepad\+\+Jan 2, 2015

  • CVE-2014-9427
    35Monitor

    sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .

    HighCVSS 7.5No exploitEPSS 18%

    php · phpJan 2, 2015

  • CVE-2013-2131
    23Monitor

    Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial

    MediumCVSS 5.0Proof of conceptEPSS 10%

    rrdtool project · rrdtoolJan 4, 2015

  • CVE-2014-9567
    43Plan

    Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to exe

    HighCVSS 7.5WeaponizedEPSS 43%

    projectsend · projectsendJan 7, 2015

  • CVE-2014-9473
    34Monitor

    Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to e

    HighCVSS 7.5Proof of conceptEPSS 13%

    deliciousdays · cformsiiJan 7, 2015

  • CVE-2014-9583
    64This week

    common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and ot

    CriticalCVSS 10.0WeaponizedEPSS 80%

    asus · wrt firmwareJan 8, 2015

  • CVE-2014-3570
    27Monitor

    The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of

    MediumCVSS 5.0Proof of conceptEPSS 21%

    openssl · opensslJan 8, 2015

  • CVE-2014-3571
    27Monitor

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dere

    MediumCVSS 5.0No exploitEPSS 22%

    openssl · opensslJan 8, 2015

  • CVE-2014-8275
    25Monitor

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows

    MediumCVSS 5.0Proof of conceptEPSS 15%

    openssl · opensslJan 8, 2015

  • CVE-2015-0205
    27Monitor

    The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a D

    MediumCVSS 5.0Proof of conceptEPSS 22%

    openssl · opensslJan 8, 2015

  • CVE-2015-0206
    37Monitor

    Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers t

    MediumCVSS 5.0No exploitEPSS 57%

    openssl · opensslJan 8, 2015

  • CVE-2015-0204
    47Plan

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL se

    MediumCVSS 4.3Proof of conceptEPSS 98%

    openssl · opensslJan 9, 2015

  • CVE-2015-0921
    40Plan

    XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows

    MediumCVSS 4.0WeaponizedEPSS 17%

    mcafee · epolicy orchestratorJan 9, 2015

  • CVE-2015-0922
    40Plan

    McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, whic

    MediumCVSS 5.0WeaponizedEPSS 13%

    mcafee · epolicy orchestratorJan 9, 2015

  • CVE-2014-100002
    40Plan

    Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a .

    MediumCVSS 5.0WeaponizedEPSS 59%

    zohocorp · manageengine supportcenter plusJan 13, 2015

  • CVE-2014-100005
    75This week

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev.

    HighCVSS 8.0KEVWeaponizedEPSS 43%

    dlink · dir-600 firmwareJan 13, 2015

  • CVE-2014-10011
    33Monitor

    Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allo

    HighCVSS 7.5Proof of conceptEPSS 10%

    trendnet · tv-ip422wJan 13, 2015

  • CVE-2014-10021
    48Plan

    Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execut

    HighCVSS 7.5WeaponizedEPSS 58%

    wpsymposiumpro · wp symposiumJan 13, 2015

  • CVE-2014-100015
    42Plan

    Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files vi

    MediumCVSS 6.4WeaponizedEPSS 57%

    solidworks · product data managementJan 13, 2015

  • CVE-2014-10037
    36Monitor

    Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a ..

    HighCVSS 7.5Proof of conceptEPSS 18%

    domphp · domphpJan 13, 2015

  • CVE-2015-0002
    40Plan

    The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008

    HighCVSS 7.2WeaponizedEPSS 13%

    microsoft · windows 7Jan 13, 2015

  • CVE-2015-0006
    27Monitor

    The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wi

    MediumCVSS 6.1Proof of conceptEPSS 11%

    microsoft · windows 7Jan 13, 2015

  • CVE-2015-0014
    69This week

    Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7

    CriticalCVSS 10.0No exploitEPSS 96%

    microsoft · windows 7Jan 13, 2015

  • CVE-2015-0015
    55Plan

    Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of servi

    HighCVSS 7.8No exploitEPSS 78%

    microsoft · windows server 2003Jan 13, 2015

  • CVE-2015-0016
    84Now

    Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server

    HighCVSS 7.8KEVWeaponizedEPSS 75%

    microsoft · windows 7Jan 13, 2015

  • CVE-2014-8636
    49Plan

    The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that ha

    HighCVSS 7.5WeaponizedEPSS 64%

    mozilla · firefoxJan 14, 2015

  • CVE-2014-9308
    41Plan

    Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart

    MediumCVSS 6.5WeaponizedEPSS 50%

    wpeasycart · wp easycartJan 15, 2015

  • CVE-2014-9195
    54Plan

    Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function

    HighCVSS 7.5WeaponizedEPSS 80%

    phoenixcontact-software · multiprogJan 16, 2015

  • CVE-2014-6593
    40Plan

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allow

    MediumCVSS 4.0WeaponizedEPSS 66%

    oracle · jrockitJan 21, 2015

  • CVE-2015-0382
    20Monitor

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability vi

    MediumCVSS 4.3No exploitEPSS 10%

    oracle · communications policy managementJan 21, 2015

  • CVE-2015-0554
    49Plan

    The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the w

    CriticalCVSS 9.4Proof of conceptEPSS 38%

    adb · p.dga4001n firmwareJan 21, 2015

  • CVE-2015-0925
    52Plan

    The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a

    CriticalCVSS 9.0WeaponizedEPSS 52%

    ipass · ipass open mobileJan 22, 2015

  • CVE-2015-0310
    66This week

    Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not p

    HighCVSS 7.8KEVWeaponizedEPSS 15%

    adobe · flash playerJan 23, 2015

  • CVE-2015-0311
    95Now

    Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and throu

    CriticalCVSS 9.8KEVWeaponizedEPSS 85%

    adobe · flash playerJan 23, 2015

  • CVE-2014-8157
    35Monitor

    Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cra

    HighCVSS 7.5No exploitEPSS 16%

    opensuse · opensuseJan 26, 2015

  • CVE-2014-8158
    31Monitor

    Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash

    MediumCVSS 6.8No exploitEPSS 14%

    jasper project · jasperJan 26, 2015

  • CVE-2015-0231
    43Plan

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.

    HighCVSS 7.5Proof of conceptEPSS 42%

    php · phpJan 27, 2015

  • CVE-2015-0232
    32Monitor

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attacke

    MediumCVSS 6.8No exploitEPSS 16%

    php · phpJan 27, 2015

  • CVE-2015-1365
    24Monitor

    Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to wri

    MediumCVSS 5.0Proof of conceptEPSS 13%

    pixabay images project · pixabay imagesJan 27, 2015

  • CVE-2015-1375
    34Monitor

    pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, whic

    HighCVSS 7.5Proof of conceptEPSS 11%

    pixabay images project · pixabay imagesJan 28, 2015

  • CVE-2015-1376
    40Plan

    pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated user

    MediumCVSS 4.0WeaponizedEPSS 33%

    pixabay images project · pixabay imagesJan 28, 2015

  • CVE-2015-0235
    68This week

    Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-depen

    CriticalCVSS 10.0WeaponizedEPSS 94%

    gnu · glibcJan 28, 2015

  • CVE-2014-4492
    36Monitor

    libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expe

    HighCVSS 7.5Proof of conceptEPSS 19%

    apple · iphone osJan 30, 2015