Code Injection

4884 CVEs technique

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2013-3402 MEDIUM This Month

An unspecified function in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execute arbitrary commands via unknown vectors, aka Bug ID CSCuh73440. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Cisco RCE Unified Communications Manager

NVD

CVSS 2.0

6.5

EPSS

0.6%

CVE-2013-2135 Maven CRITICAL PATCH Act Now

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 83.0%.

Code Injection Apache RCE Struts

NVD

CVSS 2.0

9.3

EPSS

83.0%

Threat

4.4

CVE-2013-2134 Maven CRITICAL POC PATCH THREAT Act Now

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 91.5%.

Code Injection Apache RCE Struts

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

91.5%

Threat

6.1

CVE-2013-1777 Maven CRITICAL PATCH Act Now

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

IBM Code Injection Apache RCE Geronimo +1

NVD

CVSS 2.0

10.0

EPSS

8.3%

CVE-2013-2115 Maven HIGH POC PATCH THREAT Act Now

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 87.6%.

Code Injection Apache RCE Struts

NVD Exploit-DB

CVSS 3.1

8.1

EPSS

87.6%

Threat

5.7

CVE-2013-1966 Maven CRITICAL POC PATCH THREAT Act Now

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 91.1%.

Code Injection Apache RCE Struts

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

91.1%

Threat

6.1

CVE-2013-1965 Maven CRITICAL POC PATCH THREAT Act Now

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 91.8%.

Code Injection Apache RCE Struts Struts2 Showcase

NVD

CVSS 2.0

9.3

EPSS

91.8%

Threat

6.1

CVE-2013-3178 CRITICAL Emergency

Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 59.0% and no vendor patch available.

Code Injection Denial Of Service Microsoft RCE Silverlight

NVD

CVSS 2.0

9.3

EPSS

59.0%

CVE-2013-3174 CRITICAL POC THREAT Emergency

DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 34.9%.

Code Injection Microsoft RCE Windows 7 Windows 8 +5

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

34.9%

Threat

4.4

CVE-2013-3171 CRITICAL Act Now

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Code Injection Microsoft RCE Net Framework

NVD

CVSS 2.0

9.3

EPSS

8.6%

CVE-2013-3164 CRITICAL POC THREAT Emergency

Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 15.4%.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

15.4%

CVE-2013-3162 CRITICAL POC THREAT Emergency

Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.0%.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

11.0%

CVE-2013-3161 CRITICAL POC Act Now

Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

9.4%

CVE-2013-3153 CRITICAL POC THREAT Emergency

Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.0%.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

11.0%

CVE-2013-3152 CRITICAL POC THREAT Emergency

Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 15.4%.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

15.4%

CVE-2013-3151 CRITICAL POC Act Now

Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

8.4%

CVE-2013-3150 CRITICAL POC THREAT Emergency

Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.0%.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

11.0%

CVE-2013-3149 CRITICAL POC THREAT Emergency

Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.0%.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

11.0%

CVE-2013-3148 CRITICAL POC THREAT Emergency

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

11.0%

CVE-2013-3147 CRITICAL POC THREAT Emergency

Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.0%.

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

11.0%

CVE-2013-3146 CRITICAL POC THREAT Emergency

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

15.4%

CVE-2013-3145 CRITICAL POC THREAT Emergency

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

11.0%

CVE-2013-3144 CRITICAL POC Act Now

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

8.4%

CVE-2013-3143 CRITICAL POC THREAT Emergency

Denial Of Service Buffer Overflow Code Injection Microsoft RCE +1

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

31.0%

Threat

4.3

CVE-2013-3134 CRITICAL Emergency

The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocate arrays of structures, which allows remote attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 57.7% and no vendor patch available.

Code Injection Microsoft RCE Net Framework

NVD

CVSS 2.0

9.3

EPSS

57.7%

CVE-2013-3133 CRITICAL Act Now

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Code Injection Microsoft RCE Net Framework

NVD

CVSS 2.0

9.3

EPSS

8.6%

CVE-2013-3132 CRITICAL Act Now

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Code Injection Microsoft RCE Net Framework

NVD

CVSS 2.0

9.3

EPSS

7.1%

CVE-2013-3131 CRITICAL Emergency

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in multidimensional arrays of structures, which allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 54.7% and no vendor patch available.

Code Injection Microsoft RCE Net Framework Silverlight

NVD

CVSS 2.0

9.3

EPSS

54.7%

CVE-2013-3129 HIGH Act Now

Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3,. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 51.7% and no vendor patch available.

Code Injection Microsoft RCE Net Framework Lync +12

NVD

CVSS 3.1

7.8

EPSS

51.7%

CVE-2013-3127 CRITICAL Emergency

The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Format Runtime 11 and Windows Media Player 11 and 12 allows. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 35.5% and no vendor patch available.

Code Injection Microsoft RCE Windows Media Format Runtime Windows Media Player

NVD

CVSS 2.0

9.3

EPSS

35.5%

CVE-2013-0476 MEDIUM This Month

IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to inject arbitrary FTP commands via unspecified vectors. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection IBM Sterling B2b Integrator Sterling File Gateway

NVD

CVSS 2.0

6.4

EPSS

0.2%

CVE-2013-3651 HIGH This Week

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SC_CheckError.php and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

PHP Code Injection RCE Ec Cube

NVD

CVSS 2.0

7.5

EPSS

8.9%

CVE-2013-4098 MEDIUM POC This Month

ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Code Injection Authentication Server

NVD Exploit-DB

CVSS 2.0

5.0

EPSS

4.9%

CVE-2013-3384 CRITICAL Act Now

The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Cisco RCE Ironport Asyncos

NVD

CVSS 2.0

9.0

EPSS

0.5%

CVE-2013-3383 CRITICAL Act Now

The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Cisco RCE Ironport Asyncos

NVD

CVSS 2.0

9.0

EPSS

0.6%

CVE-2013-1688 CRITICAL Act Now

The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Code Injection Mozilla RCE Firefox

NVD

CVSS 2.0

9.3

EPSS

1.2%

CVE-2013-1571 MEDIUM POC PATCH THREAT This Month

Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 26.6%.

Code Injection Java Oracle Jdk Jre +1

NVD

CVSS 2.0

4.3

EPSS

26.6%

CVE-2013-3520 HIGH POC THREAT Act Now

VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.9%.

Code Injection VMware RCE Vcenter Chargeback Manager

NVD Exploit-DB

CVSS 2.0

7.5

EPSS

81.9%

Threat

5.5

CVE-2013-3573 CRITICAL Act Now

HP Insight Diagnostics 9.4.0.4710 allows remote attackers to conduct unspecified injection attacks via unknown vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection HP Insight Diagnostics

NVD

CVSS 2.0

10.0

EPSS

1.1%

CVE-2013-0143 MEDIUM POC This Month

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Code Injection Qnap RCE Viostor Network Video Recorder Surveillance Station Pro +1

NVD Exploit-DB

CVSS 2.0

6.5

EPSS

7.2%

CVE-2013-2950 LOW Monitor

CRLF injection vulnerability in IBM WebSphere Portal 6.1.0.x before 6.1.0.3 CF26, 6.1.5.x before 6.1.5 CF26, 7.0.0.x before 7.0.0.2 CF21, and 8.0.0.x through 8.0.0.1 CF5, when home substitution (aka. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.

IBM Code Injection RCE Websphere Portal

NVD

CVSS 2.0

3.5

EPSS

0.2%

CVE-2013-1335 CRITICAL Emergency

Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code via crafted shape data in a Word document, aka "Word Shape Corruption Vulnerability.". Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 54.9% and no vendor patch available.

Code Injection Microsoft RCE Word Word Viewer

NVD

CVSS 2.0

9.3

EPSS

54.9%

CVE-2013-1323 CRITICAL Emergency

Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 54.9% and no vendor patch available.

Code Injection Microsoft RCE Publisher

NVD

CVSS 2.0

9.3

EPSS

54.9%

CVE-2013-3528 HIGH POC PATCH This Week

Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Code Injection Vanilla

NVD Exploit-DB GitHub

CVSS 2.0

7.5

EPSS

4.5%

CVE-2013-3508 MEDIUM This Month

html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

PHP Code Injection RCE Groundwork Monitor

NVD

CVSS 2.0

6.5

EPSS

0.6%

CVE-2013-3079 CRITICAL Act Now

VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary programs with root privileges by leveraging Virtual Appliance Management Interface. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection VMware RCE Vcenter Server Appliance

NVD

CVSS 2.0

9.0

EPSS

0.5%

CVE-2013-3241 MEDIUM POC This Month

export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

PHP Code Injection Phpmyadmin

NVD Exploit-DB

CVSS 2.0

4.0

EPSS

3.4%

CVE-2013-3239 PHP MEDIUM POC PATCH THREAT This Month

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 12.3%.

PHP Code Injection Apache RCE Phpmyadmin

NVD GitHub Exploit-DB

CVSS 2.0

4.6

EPSS

12.3%

CVE-2013-3221 Ruby MEDIUM POC PATCH This Month

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Code Injection Rails Ruby On Rails

NVD GitHub

CVSS 2.0

6.4

EPSS

0.5%

CVE-2013-0132 MEDIUM This Month

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.

PHP Code Injection RCE Parallels Plesk Panel

NVD

CVSS 2.0

6.8

EPSS

0.5%

CVE-2013-1296 CRITICAL Emergency

The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects in memory, which allows remote attackers to execute. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 54.0% and no vendor patch available.

Code Injection Microsoft RCE Remote Desktop Connection

NVD

CVSS 2.0

9.3

EPSS

54.0%

CVE-2013-1898 Ruby HIGH This Week

lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection RCE Thumbshooter

NVD

CVSS 2.0

7.5

EPSS

1.0%

CVE-2013-1899 MEDIUM POC THREAT This Month

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.1%.

Code Injection Denial Of Service PostgreSQL RCE Ubuntu Linux

NVD

CVSS 2.0

6.5

EPSS

81.1%

Threat

5.2

CVE-2013-0670 MEDIUM This Month

CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Siemens Code Injection Wincc Tia Portal

NVD

CVSS 2.0

4.3

EPSS

0.3%

CVE-2013-2617 Ruby HIGH This Week

lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection RCE Curl

NVD

CVSS 2.0

7.5

EPSS

1.4%

CVE-2013-2616 Ruby HIGH PATCH This Week

lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

Code Injection RCE Mini Magick

NVD

CVSS 2.0

7.5

EPSS

0.9%

CVE-2013-2615 Ruby HIGH POC This Week

lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Code Injection RCE Fastreader

NVD

CVSS 2.0

7.5

EPSS

1.0%

CVE-2013-1875 Ruby HIGH This Week

command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection RCE Command Wrap

NVD

CVSS 2.0

7.5

EPSS

0.7%

CVE-2013-0505 MEDIUM This Month

IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection IBM Sterling Multi Channel Fulfillment Solution Sterling Selling And Fulfillment Foundation

NVD

CVSS 2.0

5.5

EPSS

0.2%

CVE-2013-2549 HIGH This Week

Unspecified vulnerability in Adobe Reader 11.0.02 allows remote attackers to execute arbitrary code via vectors related to a "break into the sandbox," as demonstrated by George Hotz during a Pwn2Own. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Adobe RCE Acrobat Reader

NVD

CVSS 2.0

7.5

EPSS

5.4%

CVE-2013-0912 HIGH This Week

WebKit in Google Chrome before 25.0.1364.160 allows remote attackers to execute arbitrary code via vectors that leverage "type confusion.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Apple Google RCE Chrome

NVD

CVSS 2.0

7.5

EPSS

2.5%

CVE-2013-1762 MEDIUM This Month

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.

Buffer Overflow Code Injection RCE Stunnel

NVD

CVSS 2.0

6.6

EPSS

2.0%

CVE-2013-1491 CRITICAL Act Now

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 19.6% and no vendor patch available.

Code Injection Java Oracle RCE Jdk +1

NVD

CVSS 2.0

10.0

EPSS

19.6%

CVE-2013-1488 CRITICAL POC THREAT Emergency

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.

Code Injection Java Oracle RCE Jdk +1

NVD Exploit-DB

CVSS 2.0

10.0

EPSS

86.3%

Threat

6.1

CVE-2013-0401 CRITICAL Act Now

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 10.1% and no vendor patch available.

Code Injection Java Oracle RCE Jdk +1

NVD

CVSS 2.0

10.0

EPSS

10.1%

CVE-2012-4840 MEDIUM This Month

IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and call XPath extension. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

IBM Code Injection RCE Cognos Business Intelligence

NVD

CVSS 2.0

5.0

EPSS

0.2%

CVE-2012-6072 Maven MEDIUM PATCH This Month

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.

Code Injection Jenkins

NVD

CVSS 2.0

4.3

EPSS

0.1%

CVE-2013-0108 MEDIUM POC THREAT This Month

An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 61.4%.

Honeywell Code Injection RCE Enterprise Buildings Integrator Symmetre +1

NVD Exploit-DB

CVSS 2.0

6.8

EPSS

61.4%

Threat

4.7

CVE-2012-4707 CRITICAL Act Now

3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors that trigger an out-of-bounds memory access. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection RCE Codesys Gateway Server

NVD

CVSS 2.0

10.0

EPSS

6.7%

CVE-2012-0439 CRITICAL POC THREAT Emergency

An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.3%.

Code Injection RCE Groupwise

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

68.3%

Threat

5.4

CVE-2013-0077 CRITICAL Emergency

Quartz.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via crafted media content in (1) a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 53.0% and no vendor patch available.

Code Injection Microsoft RCE Windows Server 2003 Windows Server 2008 +2

NVD

CVSS 2.0

9.3

EPSS

53.0%

CVE-2013-1638 CRITICAL POC THREAT Emergency

Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 25.4%.

Code Injection RCE Opera Browser

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

25.4%

Threat

4.1

CVE-2013-1637 CRITICAL Act Now

Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Code Injection RCE Opera Browser

NVD

CVSS 2.0

9.3

EPSS

4.6%

CVE-2013-0758 CRITICAL POC THREAT Emergency

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.

Code Injection Mozilla Google RCE Firefox +14

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

87.4%

Threat

6.0

CVE-2013-0745 CRITICAL PATCH Act Now

The AutoWrapperChanger class in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

Code Injection Mozilla RCE Firefox Seamonkey +7

NVD

CVSS 2.0

9.3

EPSS

3.2%

CVE-2013-0618 CRITICAL Act Now

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Adobe RCE Acrobat Acrobat Reader

NVD

CVSS 2.0

10.0

EPSS

7.6%

CVE-2013-0614 CRITICAL Act Now

Code Injection Adobe RCE Acrobat Acrobat Reader

NVD

CVSS 2.0

10.0

EPSS

9.2%

CVE-2013-0608 CRITICAL Act Now

Code Injection Adobe RCE Acrobat Acrobat Reader

NVD

CVSS 2.0

10.0

EPSS

7.6%

CVE-2013-0607 CRITICAL Act Now

Code Injection Adobe RCE Acrobat Acrobat Reader

NVD

CVSS 2.0

10.0

EPSS

9.2%

CVE-2013-0007 CRITICAL Act Now

Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 24.2% and no vendor patch available.

Code Injection Microsoft RCE Xml Core Services Windows 7 +13

NVD

CVSS 2.0

9.3

EPSS

24.2%

CVE-2012-6329 HIGH POC PATCH THREAT Act Now

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.0%.

Code Injection RCE Perl

NVD Exploit-DB

CVSS 2.0

7.5

EPSS

82.0%

Threat

5.5

CVE-2012-6465 CRITICAL Act Now

Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed SVG image. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Code Injection Denial Of Service RCE Opera Browser

NVD

CVSS 2.0

9.3

EPSS

3.8%

CVE-2012-5932 CRITICAL POC THREAT Emergency

Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 49.8%.

Code Injection RCE Privileged User Manager

NVD Exploit-DB

CVSS 2.0

10.0

EPSS

49.8%

Threat

5.0

CVE-2012-5690 CRITICAL Act Now

RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allow remote attackers to execute arbitrary code via a RealAudio file that triggers access to an invalid pointer. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Code Injection RCE Realplayer Realplayer Sp

NVD

CVSS 2.0

9.3

EPSS

3.4%

CVE-2012-5142 CRITICAL Act Now

Google Chrome before 23.0.1271.97 does not properly handle history navigation, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Denial Of Service Google RCE Chrome +1

NVD

CVSS 2.0

10.0

EPSS

5.6%

CVE-2012-4791 LOW Monitor

Microsoft Exchange Server 2007 SP3 and 2010 SP1 and SP2 allows remote authenticated users to cause a denial of service (Information Store service hang) by subscribing to a crafted RSS feed, aka "RSS. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Epss exploitation probability 33.2% and no vendor patch available.

Code Injection Denial Of Service Microsoft RCE Exchange Server

NVD

CVSS 2.0

3.5

EPSS

33.2%

CVE-2012-4786 CRITICAL Emergency

The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 55.3% and no vendor patch available.

Code Injection Microsoft RCE Windows 7 Windows Server 2003 +3

NVD

CVSS 2.0

10.0

EPSS

55.3%

CVE-2012-4781 CRITICAL Emergency

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 49.4% and no vendor patch available.

Code Injection Denial Of Service Microsoft RCE Internet Explorer

NVD

CVSS 2.0

9.3

EPSS

49.4%

CVE-2012-4774 CRITICAL Emergency

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 56.8% and no vendor patch available.

Code Injection Microsoft RCE Windows 7 Windows Server 2003 +3

NVD

CVSS 2.0

9.3

EPSS

56.8%

CVE-2012-2556 CRITICAL Emergency

The OpenType Font (OTF) driver in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 46.2% and no vendor patch available.

Code Injection Microsoft RCE Windows 2003 Server Windows 7 +7

NVD

CVSS 2.0

9.3

EPSS

46.2%

CVE-2013-3402

EPSS 1% CVSS 6.5

MEDIUM This Month

Code Injection Cisco RCE +1

NVD

CVE-2013-2135 Maven

EPSS 83% 4.4 CVSS 9.3

CRITICAL PATCH Act Now

Code Injection Apache RCE +1

NVD

CVE-2013-2134 Maven

EPSS 92% 6.1 CVSS 9.3

CRITICAL POC PATCH THREAT Act Now

Code Injection Apache RCE +1

NVD Exploit-DB

CVE-2013-1777 Maven

EPSS 8% CVSS 10.0

CRITICAL PATCH Act Now

IBM Code Injection Apache +3

NVD

CVE-2013-2115 Maven

EPSS 88% 5.7 CVSS 8.1

HIGH POC PATCH THREAT Act Now

Code Injection Apache RCE +1

NVD Exploit-DB

CVE-2013-1966 Maven

EPSS 91% 6.1 CVSS 9.3

CRITICAL POC PATCH THREAT Act Now

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 91.1%.

Code Injection Apache RCE +1

NVD Exploit-DB

CVE-2013-1965 Maven

EPSS 92% 6.1 CVSS 9.3

CRITICAL POC PATCH THREAT Act Now

Code Injection Apache RCE +2

NVD

CVE-2013-3178

EPSS 59% CVSS 9.3

CRITICAL Emergency

Code Injection Denial Of Service Microsoft +2

NVD

CVE-2013-3174

EPSS 35% 4.4 CVSS 9.3

CRITICAL POC THREAT Emergency

Code Injection Microsoft RCE +7

NVD Exploit-DB

CVE-2013-3171

EPSS 9% CVSS 9.3

CRITICAL Act Now

Code Injection Microsoft RCE +1

NVD

CVE-2013-3164

EPSS 15% CVSS 9.3

CRITICAL POC THREAT Emergency