| CVE-2013-3660 Known exploited | High 7.8 | The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wind… Assigned by mitre | May 24, 2013 |
| CVE-2013-1331 Known exploited | High 7.8 | Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocatio… Assigned by microsoft | Jun 12, 2013 |
| CVE-2013-2465 Known exploited | Critical 9.8 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remo… Assigned by oracle | Jun 18, 2013 |
| CVE-2013-1690 Known exploited | High 8.8 | Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with pag… Assigned by mozilla | Jun 26, 2013 |
| CVE-2013-3163 Known exploited | High 8.8 | Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corru… Assigned by microsoft | Jul 10, 2013 |
| CVE-2013-2251 Known exploited | Critical 9.8 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. Assigned by redhat | Jul 18, 2013 |
| CVE-2013-3346 Known exploited | High 8.8 | Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vecto… Assigned by adobe | Aug 30, 2013 |
| CVE-2013-4810 Known exploited | Critical 9.8 | HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled ob… Assigned by hp | Sep 13, 2013 |
| CVE-2013-3893 Known exploited | High 8.8 | Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript s… Assigned by microsoft | Sep 18, 2013 |
| CVE-2013-3897 Known exploited | High 8.8 | Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (mem… Assigned by microsoft | Oct 9, 2013 |
| CVE-2013-3896 Known exploited | Medium 5.5 | Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silve… Assigned by microsoft | Oct 9, 2013 |
| CVE-2013-3906 Known exploited | High 7.8 | GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remo… Assigned by microsoft | Nov 6, 2013 |
| CVE-2013-3918 Known exploited | High 8.8 | The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1… Assigned by microsoft | Nov 12, 2013 |
| CVE-2013-5223 Known exploited | Medium 5.4 | Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. Assigned by mitre | Nov 15, 2013 |
| CVE-2013-6282 Known exploited | High 8.8 | The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the conten… Assigned by mitre | Nov 19, 2013 |
| CVE-2013-5065 Known exploited | High 7.8 | NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013. Assigned by microsoft | Nov 27, 2013 |
| CVE-2013-3900 Known exploited | Medium 5.5 | WinVerifyTrust Signature Validation Vulnerability Assigned by microsoft | Dec 11, 2013 |
| CVE-2014-0496 Known exploited | High 8.8 | Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. Assigned by adobe | Jan 15, 2014 |
| CVE-2014-0497 Known exploited | High 8.8 | Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute ar… Assigned by adobe | Feb 5, 2014 |
| CVE-2014-0322 Known exploited | High 8.8 | Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange… Assigned by microsoft | Feb 14, 2014 |
| CVE-2014-0502 Known exploited | High 8.8 | Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on… Assigned by adobe | Feb 21, 2014 |
| CVE-2013-7331 Known exploited | Medium 6.5 | The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet… Assigned by mitre | Feb 26, 2014 |
| CVE-2014-2120 Known exploited | Medium 5.4 | Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified… Assigned by cisco | Mar 19, 2014 |
| CVE-2014-1761 Known exploited | High 7.8 | Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2… Assigned by microsoft | Mar 24, 2014 |
| CVE-2014-0160 Known exploited | High 7.5 | The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process… Assigned by redhat | Apr 7, 2014 |
| CVE-2014-0780 Known exploited | High 7.5 | InduSoft Web Studio Path Traversal Assigned by icscert | Apr 25, 2014 |
| CVE-2014-1776 Known exploited | Critical 9.8 | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the… Assigned by microsoft | Apr 27, 2014 |
| CVE-2014-0196 Known exploited | Medium 5.5 | The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial… Assigned by redhat | May 7, 2014 |
| CVE-2014-0130 Known exploited | High 7.5 | Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when… Assigned by redhat | May 7, 2014 |
| CVE-2014-1812 Known exploited | High 8.8 | The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle… Assigned by microsoft | May 14, 2014 |
| CVE-2014-3153 Known exploited | High 7.8 | The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafte… Assigned by Chrome | Jun 7, 2014 |
| CVE-2013-3993 Known exploited | Medium 6.5 | IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified… Assigned by ibm | Jul 7, 2014 |
| CVE-2014-3120 Known exploited | High 8.1 | The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Assigned by mitre | Jul 28, 2014 |
| CVE-2014-2817 Known exploited | High 8.8 | Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." Assigned by microsoft | Aug 12, 2014 |
| CVE-2014-0546 Known exploited | High 8.8 | Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context,… Assigned by adobe | Aug 12, 2014 |
| CVE-2013-2597 Known exploited | High 8.4 | Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions… Assigned by mitre | Aug 31, 2014 |
| CVE-2014-4404 Known exploited | High 7.8 | Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-m… Assigned by apple | Sep 18, 2014 |
| CVE-2014-6271 Known exploited | Critical 9.8 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, a… Assigned by debian | Sep 24, 2014 |
| CVE-2014-7169 Known exploited | Critical 9.8 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or poss… Assigned by mitre | Sep 25, 2014 |
| CVE-2014-6278 Known exploited | High 8.8 | GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environm… Assigned by debian | Sep 30, 2014 |
| CVE-2014-6287 Known exploited | Critical 9.8 | The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a se… Assigned by mitre | Oct 7, 2014 |
| CVE-2014-4148 Known exploited | High 8.8 | win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and… Assigned by microsoft | Oct 15, 2014 |
| CVE-2014-4123 Known exploited | High 8.8 | Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploited in the wild in O… Assigned by microsoft | Oct 15, 2014 |
| CVE-2014-4114 Known exploited | High 7.8 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute… Assigned by microsoft | Oct 15, 2014 |
| CVE-2014-4113 Known exploited | High 7.8 | win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and… Assigned by microsoft | Oct 15, 2014 |
| CVE-2014-6352 Known exploited | High 7.8 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute… Assigned by microsoft | Oct 22, 2014 |
| CVE-2014-6332 Known exploited | High 8.8 | OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT… Assigned by microsoft | Nov 11, 2014 |
| CVE-2014-4077 Known exploited | High 7.8 | Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attack… Assigned by microsoft | Nov 11, 2014 |
| CVE-2014-6324 Known exploited | High 8.8 | The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012… Assigned by microsoft | Nov 18, 2014 |
| CVE-2014-8439 Known exploited | High 8.8 | Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe… Assigned by adobe | Nov 25, 2014 |
