| CVE-2013-1331 Known exploited | High 7.8 | Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocatio… Assigned by microsoft | Jun 12, 2013 |
| CVE-2013-2465 Known exploited | Critical 9.8 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remo… Assigned by oracle | Jun 18, 2013 |
| CVE-2013-1690 Known exploited | High 8.8 | Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with pag… Assigned by mozilla | Jun 26, 2013 |
| CVE-2013-4786 | High 7.5 | The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing atta… Assigned by mitre | Jul 8, 2013 |
| CVE-2013-3163 Known exploited | High 8.8 | Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corru… Assigned by microsoft | Jul 10, 2013 |
| CVE-2013-2251 Known exploited | Critical 9.8 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. Assigned by redhat | Jul 18, 2013 |
| CVE-2013-4620 Healthcare | Medium 4.3 | Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter. Assigned by mitre | Aug 9, 2013 |
| CVE-2013-4619 Healthcare | Medium 6.5 | Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_ra… Assigned by mitre | Aug 9, 2013 |
| CVE-2013-3346 Known exploited | High 8.8 | Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vecto… Assigned by adobe | Aug 30, 2013 |
| CVE-2013-4810 Known exploited | Critical 9.8 | HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled ob… Assigned by hp | Sep 13, 2013 |
| CVE-2013-3893 Known exploited | High 8.8 | Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript s… Assigned by microsoft | Sep 18, 2013 |
| CVE-2013-2808 Healthcare | High 9.3 | Heap-based buffer overflow in Xper in Philips Xper Information Management Physiomonitoring 5 components, Xper Information Management Vascular Monitoring 5 components, and Xper Information Management… Assigned by icscert | Oct 5, 2013 |
| CVE-2013-3897 Known exploited | High 8.8 | Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (mem… Assigned by microsoft | Oct 9, 2013 |
| CVE-2013-3896 Known exploited | Medium 5.5 | Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silve… Assigned by microsoft | Oct 9, 2013 |
| CVE-2013-5837 | Low 2.1 | Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1, 5.0… Assigned by oracle | Oct 16, 2013 |
| CVE-2013-5811 | Low 3.5 | Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5… Assigned by oracle | Oct 16, 2013 |
| CVE-2013-5857 | Low 3.6 | Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5… Assigned by oracle | Oct 16, 2013 |
| CVE-2013-5856 | Low 3.6 | Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5… Assigned by oracle | Oct 16, 2013 |
| CVE-2013-3906 Known exploited | High 7.8 | GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remo… Assigned by microsoft | Nov 6, 2013 |
| CVE-2013-3918 Known exploited | High 8.8 | The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1… Assigned by microsoft | Nov 12, 2013 |
| CVE-2013-5223 Known exploited | Medium 5.4 | Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. Assigned by mitre | Nov 15, 2013 |
| CVE-2013-6282 Known exploited | High 8.8 | The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the conten… Assigned by mitre | Nov 19, 2013 |
| CVE-2013-5065 Known exploited | High 7.8 | NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013. Assigned by microsoft | Nov 27, 2013 |
| CVE-2013-3900 Known exploited | Medium 5.5 | WinVerifyTrust Signature Validation Vulnerability Assigned by microsoft | Dec 11, 2013 |
| CVE-2014-0496 Known exploited | High 8.8 | Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. Assigned by adobe | Jan 15, 2014 |
| CVE-2013-0340 | Medium 6.8 | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of s… Assigned by redhat | Jan 21, 2014 |
| CVE-2014-0497 Known exploited | High 8.8 | Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute ar… Assigned by adobe | Feb 5, 2014 |
| CVE-2014-0322 Known exploited | High 8.8 | Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange… Assigned by microsoft | Feb 14, 2014 |
| CVE-2014-0502 Known exploited | High 8.8 | Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on… Assigned by adobe | Feb 21, 2014 |
| CVE-2013-4286 | Medium 5.8 | Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which al… Assigned by redhat | Feb 26, 2014 |
| CVE-2013-4590 | Medium 4.3 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a c… Assigned by redhat | Feb 26, 2014 |
| CVE-2013-4322 | Medium 4.3 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace charac… Assigned by redhat | Feb 26, 2014 |
| CVE-2013-7331 Known exploited | Medium 6.5 | The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet… Assigned by mitre | Feb 26, 2014 |
| CVE-2014-2120 Known exploited | Medium 5.4 | Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified… Assigned by cisco | Mar 19, 2014 |
| CVE-2014-1761 Known exploited | High 7.8 | Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2… Assigned by microsoft | Mar 24, 2014 |
| CVE-2014-0050 | High 7.5 | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU co… | Apr 1, 2014 |
| CVE-2014-0160 Known exploited | High 7.5 | The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process… Assigned by redhat | Apr 7, 2014 |
| CVE-2014-0459 | Medium 4.3 | Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D. Assigned by oracle | Apr 16, 2014 |
| CVE-2014-0780 Known exploited | High 7.5 | InduSoft Web Studio Path Traversal Assigned by icscert | Apr 25, 2014 |
| CVE-2014-1776 Known exploited | Critical 9.8 | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the… Assigned by microsoft | Apr 27, 2014 |
| CVE-2014-0114 | High 7.5 | Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the… Assigned by redhat | Apr 30, 2014 |
| CVE-2014-0196 Known exploited | Medium 5.5 | The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial… Assigned by redhat | May 7, 2014 |
| CVE-2014-0130 Known exploited | High 7.5 | Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when… Assigned by redhat | May 7, 2014 |
| CVE-2014-1812 Known exploited | High 8.8 | The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle… Assigned by microsoft | May 14, 2014 |
| CVE-2014-0119 | Medium 4.3 | Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attack… Assigned by redhat | May 31, 2014 |
| CVE-2014-0099 | Medium 4.3 | Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers t… Assigned by redhat | May 31, 2014 |
| CVE-2014-0096 | Medium 4.3 | java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which… Assigned by redhat | May 31, 2014 |
| CVE-2014-0075 | Medium 5.0 | Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remot… Assigned by redhat | May 31, 2014 |
| CVE-2014-3153 Known exploited | High 7.8 | The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafte… Assigned by Chrome | Jun 7, 2014 |
| CVE-2013-6825 Healthcare | High 7.2 | (1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and… Assigned by mitre | Jun 10, 2014 |
