Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: сентябрь 2019 г.

87 записей · 11 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2019-15858
    41В плане

    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import,

    ВысокаяCVSS 8,8Proof of conceptEPSS 18 %

    webcraftic · woody ad snippets3 сент. 2019 г.

  • CVE-2019-15043
    49В плане

    In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.

    ВысокаяCVSS 7,5Proof of conceptEPSS 63 %

    grafana · grafana3 сент. 2019 г.

  • CVE-2019-15889
    27Наблюдать

    The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search

    СредняяCVSS 6,1Proof of conceptEPSS 11 %

    w3eden · download manager3 сент. 2019 г.

  • CVE-2019-5475
    41В плане

    The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vuln

    ВысокаяCVSS 8,8Proof of conceptEPSS 18 %

    sonatype · nexus repository manager3 сент. 2019 г.

  • CVE-2019-10709
    42В плане

    AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS

    КритическаяCVSS 9,8Proof of conceptEPSS 11 %

    asus · precision touchpad4 сент. 2019 г.

  • CVE-2019-15813
    45В плане

    Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a we

    ВысокаяCVSS 8,8Proof of conceptEPSS 33 %

    sentrifugo · sentrifugo4 сент. 2019 г.

  • CVE-2019-14470
    49В плане

    cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/s

    СредняяCVSS 6,1Proof of conceptEPSS 82 %

    instagram-php-api project · instagram-php-api4 сент. 2019 г.

  • CVE-2019-15949
    88Срочно

    Nagios XI before 5.6.6 allows remote command execution as root.

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 77 %

    nagios · nagios xi5 сент. 2019 г.

  • CVE-2019-15954
    63На этой неделе

    An issue was discovered in Total.js CMS 12.0.0.

    КритическаяCVSS 9,9Готовый эксплойтEPSS 78 %

    totaljs · total.js cms5 сент. 2019 г.

  • CVE-2019-15029
    39Наблюдать

    FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (whic

    ВысокаяCVSS 8,8Proof of conceptEPSS 12 %

    fusionpbx · fusionpbx5 сент. 2019 г.

  • CVE-2019-15846
    50В плане

    Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.

    КритическаяCVSS 9,8Proof of conceptEPSS 35 %

    exim · exim6 сент. 2019 г.

  • CVE-2019-14813
    42В плане

    A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    artifex · ghostscript6 сент. 2019 г.

  • CVE-2019-10891
    45В плане

    An issue was discovered in D-Link DIR-806 devices.

    КритическаяCVSS 9,8Эксплойта нетEPSS 19 %

    dlink · dir-806 firmware6 сент. 2019 г.

  • CVE-2019-16097
    33Наблюдать

    core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is s

    СредняяCVSS 6,5Proof of conceptEPSS 22 %

    linuxfoundation · harbor8 сент. 2019 г.

  • CVE-2019-16113
    58В плане

    Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and th

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 77 %

    bludit · bludit8 сент. 2019 г.

  • CVE-2019-16119
    46В плане

    SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries

    КритическаяCVSS 9,8Proof of conceptEPSS 24 %

    10web · photo gallery8 сент. 2019 г.

  • CVE-2019-16123
    35Наблюдать

    In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.

    ВысокаяCVSS 7,5Proof of conceptEPSS 16 %

    kartatopia · piluscart8 сент. 2019 г.

  • CVE-2019-16124
    47В плане

    In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configurati

    КритическаяCVSS 9,8Эксплойта нетEPSS 27 %

    youphptube · youphptube8 сент. 2019 г.

  • CVE-2019-10669
    52В плане

    An issue was discovered in LibreNMS through 1.47.

    ВысокаяCVSS 7,2Готовый эксплойтEPSS 80 %

    librenms · librenms9 сент. 2019 г.

  • CVE-2019-15639
    37Наблюдать

    main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a cra

    ВысокаяCVSS 7,5Эксплойта нетEPSS 21 %

    digium · asterisk9 сент. 2019 г.

  • CVE-2019-8449
    46В плане

    The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information

    СредняяCVSS 5,3Proof of conceptEPSS 84 %

    atlassian · jira11 сент. 2019 г.

  • CVE-2019-8451
    54В плане

    The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal net

    СредняяCVSS 6,5Proof of conceptEPSS 94 %

    atlassian · jira server11 сент. 2019 г.

  • CVE-2019-16098
    37Наблюдать

    The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to

    ВысокаяCVSS 7,8Proof of conceptEPSS 19 %

    msi · afterburner11 сент. 2019 г.

  • CVE-2019-0189
    46В плане

    The java.io.ObjectInputStream is known to cause Java serialisation issues.

    КритическаяCVSS 9,8Эксплойта нетEPSS 23 %

    apache · ofbiz11 сент. 2019 г.

  • CVE-2019-0787
    39Наблюдать

    A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De

    ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-0788
    39Наблюдать

    A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De

    ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1208
    34Наблюдать

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut

    ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %

    microsoft · internet explorer11 сент. 2019 г.

  • CVE-2019-1214
    61На этой неделе

    An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, a

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 1 %

    microsoft · windows 10 150711 сент. 2019 г.

  • CVE-2019-1215
    67На этой неделе

    An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Pr

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 19 %

    microsoft · windows 10 150711 сент. 2019 г.

  • CVE-2019-1221
    36Наблюдать

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip

    ВысокаяCVSS 7,5Proof of conceptEPSS 19 %

    microsoft · internet explorer11 сент. 2019 г.

  • CVE-2019-1240
    35Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1241
    36Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1242
    35Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1243
    37Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 18 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1244
    30Наблюдать

    An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio

    СредняяCVSS 6,5Proof of conceptEPSS 12 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1245
    30Наблюдать

    An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio

    СредняяCVSS 6,5Proof of conceptEPSS 12 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1246
    35Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 12 %

    microsoft · office11 сент. 2019 г.

  • CVE-2019-1247
    35Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1248
    35Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1249
    35Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1250
    37Наблюдать

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    ВысокаяCVSS 7,8Эксплойта нетEPSS 18 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1252
    44В плане

    An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows

    СредняяCVSS 6,5Эксплойта нетEPSS 60 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1253
    64На этой неделе

    An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerab

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 11 %

    microsoft · windows 10 170311 сент. 2019 г.

  • CVE-2019-1257
    38Наблюдать

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    ВысокаяCVSS 8,8Эксплойта нетEPSS 11 %

    microsoft · sharepoint enterprise server11 сент. 2019 г.

  • CVE-2019-1280
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An atta

    ВысокаяCVSS 7,8Эксплойта нетEPSS 18 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1290
    39Наблюдать

    A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De

    ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1291
    39Наблюдать

    A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De

    ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %

    microsoft · windows 1011 сент. 2019 г.

  • CVE-2019-1297
    72На этой неделе

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 21 %

    microsoft · excel11 сент. 2019 г.

  • CVE-2019-1306
    44В плане

    A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly

    КритическаяCVSS 9,8Эксплойта нетEPSS 16 %

    microsoft · team foundation server11 сент. 2019 г.

  • CVE-2019-16256
    70На этой неделе

    Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve l

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 4 %

    trustedconnectivityalliance · s\@t browser12 сент. 2019 г.

  • CVE-2019-10392
    43В плане

    Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls

    ВысокаяCVSS 8,8Proof of conceptEPSS 26 %

    jenkins · git client12 сент. 2019 г.

  • CVE-2019-12922
    29Наблюдать

    A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.

    СредняяCVSS 6,5Proof of conceptEPSS 10 %

    phpmyadmin · phpmyadmin13 сент. 2019 г.

  • CVE-2010-5333
    44В плане

    The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an admini

    КритическаяCVSS 9,8Готовый эксплойтEPSS 16 %

    integard home project · integard home13 сент. 2019 г.

  • CVE-2019-11660
    33Наблюдать

    Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40.

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 7 %

    microfocus · data protector13 сент. 2019 г.

  • CVE-2019-5485
    58В плане

    NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability.

    КритическаяCVSS 10,0Proof of conceptEPSS 58 %

    gitlabhook project · gitlabhook13 сент. 2019 г.

  • CVE-2019-16313
    44В плане

    ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.

    ВысокаяCVSS 7,5Proof of conceptEPSS 46 %

    ifw8 · fr6 firmware14 сент. 2019 г.

  • CVE-2019-16314
    51В плане

    Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.

    КритическаяCVSS 9,8Эксплойта нетEPSS 38 %

    indexhibit · indexhibit14 сент. 2019 г.

  • CVE-2019-14540
    42В плане

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.

    КритическаяCVSS 9,8Proof of conceptEPSS 10 %

    fasterxml · jackson-databind15 сент. 2019 г.

  • CVE-2016-10956
    33Наблюдать

    The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.

    ВысокаяCVSS 7,5Proof of conceptEPSS 10 %

    mail-masta project · mail-masta16 сент. 2019 г.

  • CVE-2019-16057
    95Срочно

    The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 86 %

    dlink · dns-320 firmware16 сент. 2019 г.

  • CVE-2019-0195
    43В плане

    Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded.

    КритическаяCVSS 9,8Proof of conceptEPSS 14 %

    apache · tapestry16 сент. 2019 г.

  • CVE-2019-8368
    38Наблюдать

    OpenEMR v5.0.1-6 allows XSS.

    СредняяCVSS 6,1Эксплойта нетEPSS 45 %

    open-emr · openemr16 сент. 2019 г.

  • CVE-2019-5482
    44В плане

    Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

    КритическаяCVSS 9,8Эксплойта нетEPSS 17 %

    haxx · curl16 сент. 2019 г.

  • CVE-2019-15001
    31Наблюдать

    The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0

    ВысокаяCVSS 7,2Эксплойта нетEPSS 10 %

    atlassian · jira server19 сент. 2019 г.

  • CVE-2015-9406
    47В плане

    Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a ..

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 55 %

    mtheme-unus project · mtheme-unus20 сент. 2019 г.

  • CVE-2019-16692
    42В плане

    phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.

    КритическаяCVSS 9,8Proof of conceptEPSS 10 %

    phpipam · phpipam22 сент. 2019 г.

  • CVE-2019-16702
    42В плане

    Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /Logi

    КритическаяCVSS 9,8Proof of conceptEPSS 10 %

    integard pro project · integard pro22 сент. 2019 г.

  • CVE-2019-13063
    38Наблюдать

    Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on th

    ВысокаяCVSS 7,5Proof of conceptEPSS 27 %

    sahipro · sahi pro23 сент. 2019 г.

  • CVE-2019-1367
    76На этой неделе

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 52 %

    microsoft · internet explorer23 сент. 2019 г.

  • CVE-2019-16746
    43В плане

    An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17.

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    linux · linux kernel24 сент. 2019 г.

  • CVE-2019-16724
    61На этой неделе

    File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) bas

    КритическаяCVSS 9,8Готовый эксплойтEPSS 72 %

    upredsun · file sharing wizard24 сент. 2019 г.

  • CVE-2019-16759
    99Срочно

    vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring re

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %

    vbulletin · vbulletin24 сент. 2019 г.

  • CVE-2019-10405
    41В плане

    Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attac

    СредняяCVSS 5,4Proof of conceptEPSS 65 %

    jenkins · jenkins25 сент. 2019 г.

  • CVE-2019-16701
    41В плане

    pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing sh

    ВысокаяCVSS 8,8Proof of conceptEPSS 19 %

    netgate · pfsense25 сент. 2019 г.

  • CVE-2019-10098
    46В плане

    In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by en

    СредняяCVSS 6,1Proof of conceptEPSS 73 %

    apache · http server25 сент. 2019 г.

  • CVE-2019-12650
    44В плане

    Cisco IOS XE Software Web UI Command Injection Vulnerabilities

    ВысокаяCVSS 8,8Эксплойта нетEPSS 28 %

    cisco · ios25 сент. 2019 г.

  • CVE-2015-9436
    21Наблюдать

    The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id paramete

    СредняяCVSS 5,4Эксплойта нетEPSS 1 %

    vivwebsolutions · dynamic widgets25 сент. 2019 г.

  • CVE-2019-10082
    41В плане

    In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed,

    КритическаяCVSS 9,1Эксплойта нетEPSS 16 %

    apache · http server26 сент. 2019 г.

  • CVE-2019-10092
    48В плане

    In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.

    СредняяCVSS 6,1Proof of conceptEPSS 81 %

    apache · http server26 сент. 2019 г.

  • CVE-2019-10097
    44В плане

    In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol,

    ВысокаяCVSS 7,2Эксплойта нетEPSS 52 %

    apache · http server26 сент. 2019 г.

  • CVE-2019-16667
    51В плане

    diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands.

    ВысокаяCVSS 8,8Proof of conceptEPSS 54 %

    netgate · pfsense26 сент. 2019 г.

  • CVE-2019-16920
    99Срочно

    Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565.

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %

    dlink · dir-655 firmware27 сент. 2019 г.

  • CVE-2019-8074
    45В плане

    ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability.

    КритическаяCVSS 9,8Эксплойта нетEPSS 18 %

    adobe · coldfusion27 сент. 2019 г.

  • CVE-2019-16928
    81Срочно

    Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846.

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 41 %

    exim · exim27 сент. 2019 г.

  • CVE-2019-16996
    32Наблюдать

    In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_

    ВысокаяCVSS 7,2Proof of conceptEPSS 12 %

    metinfo · metinfo30 сент. 2019 г.

  • CVE-2019-16997
    43В плане

    In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=lan

    ВысокаяCVSS 7,2Proof of conceptEPSS 49 %

    metinfo · metinfo30 сент. 2019 г.

  • CVE-2019-16932
    52В плане

    A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.

    КритическаяCVSS 10,0Proof of conceptEPSS 39 %

    themeisle · visualizer30 сент. 2019 г.