Exploited CVEs of 2014

Every one of the 34 is a mark on the map. Named now: 1 to 26, most at risk first.

1. ShellShock - Remote Code ExecutionCVE-2014-6271GNU · CVSS 9.8 · 100% likely

   CWE-78GNU1 bounty report

2. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive infor…CVE-2014-0160OpenSSL · CVSS 7.5 · 100% likely

   CWE-125OpenSSL2 bounty reports

3. GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wr…CVE-2014-7169GNU · CVSS 9.8 · 100% likely

   CWE-78GNU

4. Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote att…CVE-2014-0497Adobe · CVSS 8.8 · 100% likely

   CWE-191Adobe

5. GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands vi…CVE-2014-6278GNU · CVSS 8.8 · 100% likelycovered by CyberSIXT

   CWE-78GNU1 article

6. HTTP File Server <2.3c - Remote Command ExecutionCVE-2014-6287Rejetto · CVSS 9.8 · 99% likely

   CWE-94Rejetto

7. OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold an…CVE-2014-6332Microsoft · CVSS 8.8 · 95% likely

   CWE-119Microsoft

8. ElasticSearch v1.1.1/1.2 RCECVE-2014-3120Elastic · CVSS 8.1 · 89% likely

   CWE-284Elastic

9. The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and…CVE-2014-6324Microsoft · CVSS 8.8 · 87% likely

   MicrosoftThreat Group-3390

10. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows S…CVE-2014-4113Microsoft · CVSS 7.8 · 87% likely

    Microsoft

11. Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and…CVE-2014-0322Microsoft · CVSS 8.8 · 85% likely

    CWE-416MicrosoftAxiom

12. Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vec…CVE-2014-1776Microsoft · CVSS 9.8 · 83% likely

    CWE-416MicrosoftAPT3

13. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote a…CVE-2014-4114Microsoft · CVSS 7.8 · 82% likely

    MicrosoftBRONZE BUTLERPatchwork

14. Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Ser…CVE-2014-1761Microsoft · CVSS 7.8 · 78% likely

    CWE-787MicrosoftCloud Atlas

15. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote a…CVE-2014-6352Microsoft · CVSS 7.8 · 77% likely

    MicrosoftBlackTech

16. InduSoft Web Studio Path TraversalCVE-2014-0780InduSoft · CVSS 9.8 · 75% likely

    CWE-22Indusoft

17. The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does…CVE-2014-1812Microsoft · CVSS 8.8 · 65% likely

    CWE-522Microsoft

18. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows S…CVE-2014-4148Microsoft · CVSS 8.8 · 60% likely

    CWE-94Microsoft

19. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed,…CVE-2014-4077Microsoft · CVSS 7.8 · 55% likely

    Microsoft

20. Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x…CVE-2014-0130Rails · CVSS 7.5 · 54% likely

    CWE-22Rails1 bounty report

21. The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet host…CVE-2013-7331Microsoft · CVSS 6.5 · 50% likely

    CWE-209Microsoft

22. Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that pr…CVE-2014-4404Apple · CVSS 7.8 · 49% likely

    CWE-787Apple

23. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploi…CVE-2014-4123Microsoft · CVSS 8.8 · 47% likely

    Microsoft

24. Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to ex…CVE-2014-9163Adobe · CVSS 7.8 · 45% likely

    CWE-121Adobe

25. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecif…CVE-2014-0496Adobe · CVSS 8.8 · 40% likely

    CWE-416Adobe

26. The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain pri…CVE-2014-3153Linux · CVSS 7.8 · 37% likely

    Linux

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.