По дате публикации
Эксплуатируемые и новые серьёзные CVE: август 2019 г.
86 записей · 6 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
83Срочно | CVE-2019-0193Готовый эксплойт | In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whiapache · solr · CWE-94 | Высокая7,2 | KEV | 83,5 % | 1 авг. 2019 г. |
47В плане | CVE-2019-14529Proof of concept | OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.open-emr · openemr · CWE-89 | Критическая9,8 | — | 28,0 % | 2 авг. 2019 г. |
45В плане | CVE-2019-14348Proof of concept | The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seasobeardev · joomsport · CWE-89 | Критическая9,8 | — | 20,5 % | 5 авг. 2019 г. |
29Наблюдать | CVE-2019-14696Proof of concept | Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.open-school · open-school · CWE-79 | Средняя6,1 | — | 15,6 % | 6 авг. 2019 г. |
41В плане | CVE-2019-1912Proof of concept | Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerabilitycisco · sf-220-24 firmware · CWE-285 | Критическая9,1 | — | 17,0 % | 7 авг. 2019 г. |
47В плане | CVE-2019-1913Proof of concept | Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilitiescisco · sf-220-24 firmware · CWE-119 | Критическая9,8 | — | 25,9 % | 7 авг. 2019 г. |
35Наблюдать | CVE-2019-1914Proof of concept | Cisco Small Business 220 Series Smart Switches Command Injection Vulnerabilitycisco · sf-220-24 firmware · CWE-20 | Высокая7,2 | — | 24,8 % | 7 авг. 2019 г. |
27Наблюдать | CVE-2019-14750Proof of concept | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.enhancesoft · osticket · CWE-79 | Средняя6,1 | — | 10,9 % | 7 авг. 2019 г. |
59В плане | CVE-2019-13101Proof of concept | An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices.dlink · dir-600m firmware · CWE-306 | Критическая9,8 | — | 67,0 % | 8 авг. 2019 г. |
53В плане | CVE-2019-14234Proof of concept | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.djangoproject · django · CWE-89 | Критическая9,8 | — | 47,6 % | 9 авг. 2019 г. |
32Наблюдать | CVE-2019-14312Proof of concept | Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer.aptana · jaxer · CWE-22 | Средняя6,5 | — | 20,5 % | 9 авг. 2019 г. |
47В плане | CVE-2019-12256Эксплойта нет | Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component.windriver · vxworks · CWE-120 | Критическая9,8 | — | 26,6 % | 9 авг. 2019 г. |
60На этой неделе | CVE-2019-12257Эксплойта нет | Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.windriver · vxworks · CWE-120 | Высокая8,8 | — | 84,1 % | 9 авг. 2019 г. |
35Наблюдать | CVE-2019-12259Эксплойта нет | Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component.windriver · vxworks · CWE-476 | Высокая7,5 | — | 15,8 % | 9 авг. 2019 г. |
39Наблюдать | CVE-2019-12265Эксплойта нет | Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component.windriver · vxworks · CWE-401 | Средняя5,3 | — | 59,7 % | 9 авг. 2019 г. |
94Срочно | CVE-2019-11581Готовый эксплойт | There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail aatlassian · jira server · CWE-74 | Критическая9,8 | KEV | 84,6 % | 9 авг. 2019 г. |
62На этой неделе | CVE-2019-12255Proof of concept | Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4).windriver · vxworks · CWE-120 | Критическая9,8 | — | 75,0 % | 9 авг. 2019 г. |
60На этой неделе | CVE-2019-12258Готовый эксплойт | Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component.windriver · vxworks · CWE-384 | Высокая7,5 | — | 22,7 % | 9 авг. 2019 г. |
46В плане | CVE-2019-12260Эксплойта нет | Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4).windriver · vxworks · CWE-120 | Критическая9,8 | — | 23,2 % | 9 авг. 2019 г. |
39Наблюдать | CVE-2019-13462Proof of concept | Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.lansweeper · lansweeper · CWE-89 | Критическая9,1 | — | 11,3 % | 12 авг. 2019 г. |
55В плане | CVE-2019-14530Proof of concept | An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter.open-emr · openemr · CWE-22 | Высокая8,8 | — | 65,5 % | 13 авг. 2019 г. |
48В плане | CVE-2019-9511Proof of concept | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 59,5 % | 13 авг. 2019 г. |
55В плане | CVE-2019-9512Эксплойта нет | Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 83,4 % | 13 авг. 2019 г. |
54В плане | CVE-2019-9513Эксплойта нет | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 81,5 % | 13 авг. 2019 г. |
55В плане | CVE-2019-9514Эксплойта нет | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 82,8 % | 13 авг. 2019 г. |
56В плане | CVE-2019-9515Эксплойта нет | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 87,3 % | 13 авг. 2019 г. |
43В плане | CVE-2019-9516Эксплойта нет | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Средняя6,5 | — | 56,2 % | 13 авг. 2019 г. |
38Наблюдать | CVE-2019-9517Эксплойта нет | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 27,8 % | 13 авг. 2019 г. |
38Наблюдать | CVE-2019-9518Эксплойта нет | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 25,4 % | 13 авг. 2019 г. |
71На этой неделе | CVE-2019-0344Готовый эксплойт | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possisap · commerce cloud · CWE-502 | Критическая9,8 | KEV | 7,0 % | 14 авг. 2019 г. |
33Наблюдать | CVE-2019-14974Proof of concept | SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.sugarcrm · sugarcrm · CWE-79 | Средняя6,1 | — | 28,4 % | 14 авг. 2019 г. |
39Наблюдать | CVE-2019-1144Proof of concept | Microsoft Graphics Remote Code Execution Vulnerabilitymicrosoft · windows 10 · CWE-415 | Высокая8,8 | — | 13,0 % | 14 авг. 2019 г. |
39Наблюдать | CVE-2019-1145Proof of concept | Microsoft Graphics Remote Code Execution Vulnerabilitymicrosoft · windows 10 · CWE-119 | Высокая8,8 | — | 13,0 % | 14 авг. 2019 г. |
39Наблюдать | CVE-2019-1149Proof of concept | Microsoft Graphics Remote Code Execution Vulnerabilitymicrosoft · office · CWE-787 | Высокая8,8 | — | 13,9 % | 14 авг. 2019 г. |
43В плане | CVE-2019-1150Proof of concept | Microsoft Graphics Remote Code Execution Vulnerabilitymicrosoft · windows 10 · CWE-787 | Высокая8,8 | — | 26,2 % | 14 авг. 2019 г. |
40В плане | CVE-2019-1151Proof of concept | Microsoft Graphics Remote Code Execution Vulnerabilitymicrosoft · office · CWE-787 | Высокая8,8 | — | 15,4 % | 14 авг. 2019 г. |
39Наблюдать | CVE-2019-1152Proof of concept | Microsoft Graphics Remote Code Execution Vulnerabilitymicrosoft · windows 10 · CWE-787 | Высокая8,8 | — | 13,0 % | 14 авг. 2019 г. |
34Наблюдать | CVE-2019-1159Эксплойта нет | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 10 | Высокая7,8 | — | 11,3 % | 14 авг. 2019 г. |
62На этой неделе | CVE-2019-1181Эксплойта нет | Remote Desktop Services Remote Code Execution Vulnerabilitymicrosoft · windows 10 | Критическая9,8 | — | 75,7 % | 14 авг. 2019 г. |
44В плане | CVE-2019-1182Эксплойта нет | Remote Desktop Services Remote Code Execution Vulnerabilitymicrosoft · windows 10 | Критическая9,8 | — | 16,8 % | 14 авг. 2019 г. |
47В плане | CVE-2019-1184Proof of concept | Windows Elevation of Privilege Vulnerabilitymicrosoft · windows 10 | Средняя6,7 | — | 70,2 % | 14 авг. 2019 г. |
33Наблюдать | CVE-2019-1225Эксплойта нет | Remote Desktop Protocol Server Information Disclosure Vulnerabilitymicrosoft · windows 10 · CWE-200 | Высокая7,5 | — | 10,5 % | 14 авг. 2019 г. |
34Наблюдать | CVE-2019-12854Эксплойта нет | Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory.squid-cache · squid | Высокая7,5 | — | 11,7 % | 15 авг. 2019 г. |
40В плане | CVE-2019-14422Proof of concept | An issue was discovered in in TortoiseSVN 1.12.1.tortoisesvn · tortoisesvn | Высокая8,8 | — | 16,3 % | 15 авг. 2019 г. |
35Наблюдать | CVE-2019-13510Эксплойта нет | Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416.rockwellautomation · arena · CWE-416 | Высокая7,8 | — | 12,0 % | 15 авг. 2019 г. |
34Наблюдать | CVE-2019-10081Эксплойта нет | HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the apache · http server · CWE-787 | Высокая7,5 | — | 14,5 % | 15 авг. 2019 г. |
62На этой неделе | CVE-2019-9851Готовый эксплойт | LibreLogo global-event script executionlibreoffice · libreoffice · CWE-20 | Критическая9,8 | — | 77,8 % | 15 авг. 2019 г. |
47В плане | CVE-2019-15106Proof of concept | An issue was discovered in Zoho ManageEngine OpManager in builds before 14310.zohocorp · manageengine opmanager · CWE-306 | Критическая9,8 | — | 25,4 % | 15 авг. 2019 г. |
99Срочно | CVE-2019-15107Готовый эксплойт | An issue was discovered in Webmin <=1.920.webmin · webmin · CWE-78 | Критическая9,8 | KEV | 99,7 % | 15 авг. 2019 г. |
42В плане | CVE-2019-7964Эксплойта нет | Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability.adobe · experience manager | Критическая9,8 | — | 10,2 % | 16 авг. 2019 г. |
53В плане | CVE-2015-9323Proof of concept | The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.duckdev · 404 to 301 · CWE-89 | Критическая9,8 | — | 46,1 % | 16 авг. 2019 г. |
40В плане | CVE-2019-3963Эксплойта нет | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.open-emr · openemr · CWE-79 | Средняя6,1 | — | 52,7 % | 20 авг. 2019 г. |
40В плане | CVE-2019-3964Эксплойта нет | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.open-emr · openemr · CWE-79 | Средняя6,1 | — | 52,7 % | 20 авг. 2019 г. |
35Наблюдать | CVE-2019-3967Эксплойта нет | In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers toopen-emr · openemr · CWE-22 | Средняя6,5 | — | 29,4 % | 20 авг. 2019 г. |
46В плане | CVE-2019-8016Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-787 | Критическая9,8 | — | 22,0 % | 20 авг. 2019 г. |
43В плане | CVE-2019-8017Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-119 | Критическая9,8 | — | 13,3 % | 20 авг. 2019 г. |
44В плане | CVE-2019-8024Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-416 | Критическая9,8 | — | 15,1 % | 20 авг. 2019 г. |
44В плане | CVE-2019-8041Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-787 | Критическая9,8 | — | 17,9 % | 20 авг. 2019 г. |
44В плане | CVE-2019-8042Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-787 | Критическая9,8 | — | 16,8 % | 20 авг. 2019 г. |
34Наблюдать | CVE-2019-8043Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-125 | Высокая7,5 | — | 13,4 % | 20 авг. 2019 г. |
43В плане | CVE-2019-8044Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-415 | Критическая9,8 | — | 14,4 % | 20 авг. 2019 г. |
44В плане | CVE-2019-8045Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-119 | Критическая9,8 | — | 16,0 % | 20 авг. 2019 г. |
44В плане | CVE-2019-8046Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-787 | Критическая9,8 | — | 17,9 % | 20 авг. 2019 г. |
49В плане | CVE-2019-8048Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-119 | Критическая9,8 | — | 34,5 % | 20 авг. 2019 г. |
45В плане | CVE-2019-8049Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-787 | Критическая9,8 | — | 19,6 % | 20 авг. 2019 г. |
51В плане | CVE-2019-8050Proof of concept | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earadobe · acrobat dc · CWE-787 | Критическая9,8 | — | 40,6 % | 20 авг. 2019 г. |
38Наблюдать | CVE-2019-10086Эксплойта нет | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to accessapache · commons beanutils · CWE-502 | Высокая7,3 | — | 28,3 % | 20 авг. 2019 г. |
40В плане | CVE-2019-12624Proof of concept | Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerabilitycisco · ios xe · CWE-352 | Высокая8,8 | — | 18,1 % | 21 авг. 2019 г. |
64На этой неделе | CVE-2019-1935Готовый эксплойт | Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerabilitycisco · integrated management controller supervisor · CWE-798 | Критическая9,8 | — | 83,3 % | 21 авг. 2019 г. |
40В плане | CVE-2019-1936Готовый эксплойт | Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection Vulnerabilitycisco · integrated management controller supervisor · CWE-20 | Высокая7,2 | — | 39,4 % | 21 авг. 2019 г. |
62На этой неделе | CVE-2019-1937Готовый эксплойт | Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerabilitycisco · integrated management controller supervisor · CWE-287 | Критическая9,8 | — | 75,8 % | 21 авг. 2019 г. |
33Наблюдать | CVE-2016-10924Proof of concept | The ebook-download plugin before 1.2 for WordPress has directory traversal.zedna ebook download project · zedna ebook download · CWE-22 | Высокая7,5 | — | 11,6 % | 22 авг. 2019 г. |
43В плане | CVE-2017-18580Proof of concept | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.getshortcodes · shortcodes ultimate · CWE-20 | Критическая9,8 | — | 12,0 % | 22 авг. 2019 г. |
34Наблюдать | CVE-2019-11013Proof of concept | Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability.softvelum · nimble streamer · CWE-22 | Средняя6,5 | — | 26,3 % | 22 авг. 2019 г. |
26Наблюдать | CVE-2019-8446Proof of concept | The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authoratlassian · jira server · CWE-863 | Средняя5,3 | — | 17,5 % | 23 авг. 2019 г. |
36Наблюдать | CVE-2019-15637Proof of concept | Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a tableau · tableau server · CWE-611 | Высокая8,1 | — | 14,3 % | 26 авг. 2019 г. |
45В плане | CVE-2019-15642Proof of concept | rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an ewebmin · webmin · CWE-94 | Высокая8,8 | — | 34,7 % | 26 авг. 2019 г. |
39Наблюдать | CVE-2019-7989Эксплойта нет | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability.adobe · photoshop cc · CWE-77 | Высокая8,8 | — | 14,2 % | 26 авг. 2019 г. |
52В плане | CVE-2019-14314Proof of concept | A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.imagely · nextgen gallery · CWE-89 | Критическая9,8 | — | 43,3 % | 27 авг. 2019 г. |
76На этой неделе | CVE-2019-15752Готовый эксплойт | Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exdocker · docker · CWE-732 | Высокая7,8 | KEV | 48,6 % | 28 авг. 2019 г. |
55В плане | CVE-2019-11248Proof of concept | Kubernetes kubelet exposes /debug/pprof info on healthz portkubernetes · kubernetes · CWE-419 | Высокая8,2 | — | 75,0 % | 28 авг. 2019 г. |
58В плане | CVE-2019-11500Эксплойта нет | In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings.dovecot · dovecot · CWE-787 | Критическая9,8 | — | 62,3 % | 29 авг. 2019 г. |
38Наблюдать | CVE-2019-3394Proof of concept | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting.atlassian · confluence · CWE-22 | Высокая8,8 | — | 11,0 % | 29 авг. 2019 г. |
69На этой неделе | CVE-2019-13608Готовый эксплойт | Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.citrix · storefront server · CWE-611 | Высокая7,5 | KEV | 30,0 % | 29 авг. 2019 г. |
35Наблюдать | CVE-2019-12402Эксплойта нет | The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speciapache · commons compress · CWE-835 | Высокая7,5 | — | 16,1 % | 30 авг. 2019 г. |
33Наблюдать | CVE-2019-15821Эксплойта нет | The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.bold-themes · bold page builder | Высокая7,5 | — | 11,0 % | 30 авг. 2019 г. |
- CVE-2019-019383Срочно
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 83 %apache · solr1 авг. 2019 г.
- CVE-2019-1452947В плане
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
КритическаяCVSS 9,8Proof of conceptEPSS 28 %open-emr · openemr2 авг. 2019 г.
- CVE-2019-1434845В плане
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seaso
КритическаяCVSS 9,8Proof of conceptEPSS 20 %beardev · joomsport5 авг. 2019 г.
- CVE-2019-1469629Наблюдать
Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.
СредняяCVSS 6,1Proof of conceptEPSS 15 %open-school · open-school6 авг. 2019 г.
- CVE-2019-191241В плане
Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability
КритическаяCVSS 9,1Proof of conceptEPSS 17 %cisco · sf-220-24 firmware7 авг. 2019 г.
- CVE-2019-191347В плане
Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities
КритическаяCVSS 9,8Proof of conceptEPSS 25 %cisco · sf-220-24 firmware7 авг. 2019 г.
- CVE-2019-191435Наблюдать
Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability
ВысокаяCVSS 7,2Proof of conceptEPSS 24 %cisco · sf-220-24 firmware7 авг. 2019 г.
- CVE-2019-1475027Наблюдать
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
СредняяCVSS 6,1Proof of conceptEPSS 10 %enhancesoft · osticket7 авг. 2019 г.
- CVE-2019-1310159В плане
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices.
КритическаяCVSS 9,8Proof of conceptEPSS 67 %dlink · dir-600m firmware8 авг. 2019 г.
- CVE-2019-1423453В плане
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.
КритическаяCVSS 9,8Proof of conceptEPSS 47 %djangoproject · django9 авг. 2019 г.
- CVE-2019-1431232Наблюдать
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer.
СредняяCVSS 6,5Proof of conceptEPSS 20 %aptana · jaxer9 авг. 2019 г.
- CVE-2019-1225647В плане
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component.
КритическаяCVSS 9,8Эксплойта нетEPSS 26 %windriver · vxworks9 авг. 2019 г.
- CVE-2019-1225760На этой неделе
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.
ВысокаяCVSS 8,8Эксплойта нетEPSS 84 %windriver · vxworks9 авг. 2019 г.
- CVE-2019-1225935Наблюдать
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component.
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %windriver · vxworks9 авг. 2019 г.
- CVE-2019-1226539Наблюдать
Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component.
СредняяCVSS 5,3Эксплойта нетEPSS 59 %windriver · vxworks9 авг. 2019 г.
- CVE-2019-1158194Срочно
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail a
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 84 %atlassian · jira server9 авг. 2019 г.
- CVE-2019-1225562На этой неделе
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4).
КритическаяCVSS 9,8Proof of conceptEPSS 75 %windriver · vxworks9 авг. 2019 г.
- CVE-2019-1225860На этой неделе
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component.
ВысокаяCVSS 7,5Готовый эксплойтEPSS 22 %windriver · vxworks9 авг. 2019 г.
- CVE-2019-1226046В плане
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4).
КритическаяCVSS 9,8Эксплойта нетEPSS 23 %windriver · vxworks9 авг. 2019 г.
- CVE-2019-1346239Наблюдать
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.
КритическаяCVSS 9,1Proof of conceptEPSS 11 %lansweeper · lansweeper12 авг. 2019 г.
- CVE-2019-1453055В плане
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter.
ВысокаяCVSS 8,8Proof of conceptEPSS 65 %open-emr · openemr13 авг. 2019 г.
- CVE-2019-951148В плане
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
ВысокаяCVSS 7,5Proof of conceptEPSS 59 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951255В плане
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 83 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951354В плане
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 81 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951455В плане
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 82 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951556В плане
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 87 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951643В плане
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
СредняяCVSS 6,5Эксплойта нетEPSS 56 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951738Наблюдать
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 27 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951838Наблюдать
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 25 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-034471На этой неделе
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possi
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 7 %sap · commerce cloud14 авг. 2019 г.
- CVE-2019-1497433Наблюдать
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
СредняяCVSS 6,1Proof of conceptEPSS 28 %sugarcrm · sugarcrm14 авг. 2019 г.
- CVE-2019-114439Наблюдать
Microsoft Graphics Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-114539Наблюдать
Microsoft Graphics Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-114939Наблюдать
Microsoft Graphics Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %microsoft · office14 авг. 2019 г.
- CVE-2019-115043В плане
Microsoft Graphics Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 26 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-115140В плане
Microsoft Graphics Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 15 %microsoft · office14 авг. 2019 г.
- CVE-2019-115239Наблюдать
Microsoft Graphics Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-115934Наблюдать
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-118162На этой неделе
Remote Desktop Services Remote Code Execution Vulnerability
КритическаяCVSS 9,8Эксплойта нетEPSS 75 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-118244В плане
Remote Desktop Services Remote Code Execution Vulnerability
КритическаяCVSS 9,8Эксплойта нетEPSS 16 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-118447В плане
Windows Elevation of Privilege Vulnerability
СредняяCVSS 6,7Proof of conceptEPSS 70 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-122533Наблюдать
Remote Desktop Protocol Server Information Disclosure Vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %microsoft · windows 1014 авг. 2019 г.
- CVE-2019-1285434Наблюдать
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory.
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %squid-cache · squid15 авг. 2019 г.
- CVE-2019-1442240В плане
An issue was discovered in in TortoiseSVN 1.12.1.
ВысокаяCVSS 8,8Proof of conceptEPSS 16 %tortoisesvn · tortoisesvn15 авг. 2019 г.
- CVE-2019-1351035Наблюдать
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416.
ВысокаяCVSS 7,8Эксплойта нетEPSS 12 %rockwellautomation · arena15 авг. 2019 г.
- CVE-2019-1008134Наблюдать
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the
ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %apache · http server15 авг. 2019 г.
- CVE-2019-985162На этой неделе
LibreLogo global-event script execution
КритическаяCVSS 9,8Готовый эксплойтEPSS 77 %libreoffice · libreoffice15 авг. 2019 г.
- CVE-2019-1510647В плане
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310.
КритическаяCVSS 9,8Proof of conceptEPSS 25 %zohocorp · manageengine opmanager15 авг. 2019 г.
- CVE-2019-1510799Срочно
An issue was discovered in Webmin <=1.920.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %webmin · webmin15 авг. 2019 г.
- CVE-2019-796442В плане
Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability.
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %adobe · experience manager16 авг. 2019 г.
- CVE-2015-932353В плане
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
КритическаяCVSS 9,8Proof of conceptEPSS 46 %duckdev · 404 to 30116 авг. 2019 г.
- CVE-2019-396340В плане
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.
СредняяCVSS 6,1Эксплойта нетEPSS 52 %open-emr · openemr20 авг. 2019 г.
- CVE-2019-396440В плане
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.
СредняяCVSS 6,1Эксплойта нетEPSS 52 %open-emr · openemr20 авг. 2019 г.
- CVE-2019-396735Наблюдать
In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to
СредняяCVSS 6,5Эксплойта нетEPSS 29 %open-emr · openemr20 авг. 2019 г.
- CVE-2019-801646В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 22 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-801743В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 13 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-802444В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 15 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804144В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 17 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804244В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 16 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804334Наблюдать
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
ВысокаяCVSS 7,5Proof of conceptEPSS 13 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804443В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 14 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804544В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 16 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804644В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 17 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804849В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 34 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-804945В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 19 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-805051В плане
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear
КритическаяCVSS 9,8Proof of conceptEPSS 40 %adobe · acrobat dc20 авг. 2019 г.
- CVE-2019-1008638Наблюдать
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access
ВысокаяCVSS 7,3Эксплойта нетEPSS 28 %apache · commons beanutils20 авг. 2019 г.
- CVE-2019-1262440В плане
Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 18 %cisco · ios xe21 авг. 2019 г.
- CVE-2019-193564На этой неделе
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
КритическаяCVSS 9,8Готовый эксплойтEPSS 83 %cisco · integrated management controller supervisor21 авг. 2019 г.
- CVE-2019-193640В плане
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection Vulnerability
ВысокаяCVSS 7,2Готовый эксплойтEPSS 39 %cisco · integrated management controller supervisor21 авг. 2019 г.
- CVE-2019-193762На этой неделе
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
КритическаяCVSS 9,8Готовый эксплойтEPSS 75 %cisco · integrated management controller supervisor21 авг. 2019 г.
- CVE-2016-1092433Наблюдать
The ebook-download plugin before 1.2 for WordPress has directory traversal.
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %zedna ebook download project · zedna ebook download22 авг. 2019 г.
- CVE-2017-1858043В плане
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
КритическаяCVSS 9,8Proof of conceptEPSS 12 %getshortcodes · shortcodes ultimate22 авг. 2019 г.
- CVE-2019-1101334Наблюдать
Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability.
СредняяCVSS 6,5Proof of conceptEPSS 26 %softvelum · nimble streamer22 авг. 2019 г.
- CVE-2019-844626Наблюдать
The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect author
СредняяCVSS 5,3Proof of conceptEPSS 17 %atlassian · jira server23 авг. 2019 г.
- CVE-2019-1563736Наблюдать
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a
ВысокаяCVSS 8,1Proof of conceptEPSS 14 %tableau · tableau server26 авг. 2019 г.
- CVE-2019-1564245В плане
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an e
ВысокаяCVSS 8,8Proof of conceptEPSS 34 %webmin · webmin26 авг. 2019 г.
- CVE-2019-798939Наблюдать
Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability.
ВысокаяCVSS 8,8Эксплойта нетEPSS 14 %adobe · photoshop cc26 авг. 2019 г.
- CVE-2019-1431452В плане
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.
КритическаяCVSS 9,8Proof of conceptEPSS 43 %imagely · nextgen gallery27 авг. 2019 г.
- CVE-2019-1575276На этой неделе
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.ex
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 48 %docker · docker28 авг. 2019 г.
- CVE-2019-1124855В плане
Kubernetes kubelet exposes /debug/pprof info on healthz port
ВысокаяCVSS 8,2Proof of conceptEPSS 75 %kubernetes · kubernetes28 авг. 2019 г.
- CVE-2019-1150058В плане
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings.
КритическаяCVSS 9,8Эксплойта нетEPSS 62 %dovecot · dovecot29 авг. 2019 г.
- CVE-2019-339438Наблюдать
There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting.
ВысокаяCVSS 8,8Proof of conceptEPSS 11 %atlassian · confluence29 авг. 2019 г.
- CVE-2019-1360869На этой неделе
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 30 %citrix · storefront server29 авг. 2019 г.
- CVE-2019-1240235Наблюдать
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speci
ВысокаяCVSS 7,5Эксплойта нетEPSS 16 %apache · commons compress30 авг. 2019 г.
- CVE-2019-1582133Наблюдать
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %bold-themes · bold page builder30 авг. 2019 г.