Quickbooks
Vendor:
First CVE: Sep 5, 2007 · Active for 18 years
12
Total CVEs
More Total CVEs than 90% of tracked products
6.0
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
4.6
Avg CVSS
Higher Avg CVSS than 5% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Quickbooks over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 5, 2007
18 years ago
Most Recent CVE
Sep 6, 2012
5,069 days ago
CVE Severity & Scoring
Quickbooks12 CVEs
58%
17%
25%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown12 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown12 (100.0%)
User Interaction
None0 (0.0%)
Unknown12 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown12 (100.0%)
Top CVEs
Signals from CVEs in this product scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-6387HIGH Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping | Dec 15, 2007 | 9.3 | 54 | NO | YES |
CVE-2007-0322HIGH Multiple stack-based buffer overflows in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to execute arbitrary code via unspecified vectors. | Sep 5, 2007 | 9.3 | 25 | NO | NO |
CVE-2007-4471HIGH Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified | Sep 5, 2007 | 9.3 | 25 | NO | NO |
CVE-2012-2418MEDIUM Heap-based buffer overflow in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, | Apr 25, 2012 | 6.8 | 22 | NO | NO |
CVE-2010-5198MEDIUM Multiple untrusted search path vulnerabilities in Intuit QuickBooks 2010 allow local users to gain privileges via a Trojan horse (1) dbicudtx11.dll, (2) mfc90enu.dll, or (3) mfc90l | Sep 6, 2012 | 6.9 | 21 | NO | NO |
The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used | Apr 25, 2012 | 1.8 | 14 | NO | NO |
Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality. | Apr 25, 2012 | 2.9 | 14 | NO | NO |
The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used | Apr 25, 2012 | 1.8 | 13 | NO | NO |
The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used | Apr 25, 2012 | 1.8 | 13 | NO | NO |
Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 thr | Apr 25, 2012 | 1.8 | 13 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (12 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
8.3% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (12 CVEs).
Media Mentions
Signals from CVEs in this product scope (12 CVEs).
Top CNAs Publishing CVEs For Quickbooks
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2012 | 8 | 2.6 | 1.4% | 0 | 0 |
| 2011 | 8 | 2.6 | 1.4% | 0 | 0 |
| 2010 | 9 | 3.0 | 1.3% | 0 | 0 |
| 2009 | 8 | 2.6 | 1.4% | 0 | 0 |