По дате публикации
Эксплуатируемые и новые серьёзные CVE: октябрь 2019 г.
99 записей · 7 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
43В плане | CVE-2019-15039Proof of concept | An issue was discovered in JetBrains TeamCity 2018.2.4.jetbrains · teamcity · CWE-22 | Критическая9,8 | — | 12,9 % | 1 окт. 2019 г. |
59В плане | CVE-2019-12630Эксплойта нет | Cisco Security Manager Java Deserialization Vulnerabilitycisco · security manager · CWE-20 | Критическая9,8 | — | 65,8 % | 2 окт. 2019 г. |
34Наблюдать | CVE-2019-16328Готовый эксплойт | In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes crpyc project · rpyc · CWE-1321 | Высокая7,5 | — | 13,0 % | 3 окт. 2019 г. |
48В плане | CVE-2019-11932Proof of concept | A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in Wwhatsapp · whatsapp · CWE-415 | Высокая8,8 | — | 44,5 % | 3 окт. 2019 г. |
43В плане | CVE-2019-17132Proof of concept | vBulletin through 5.5.4 mishandles custom avatars.vbulletin · vbulletin · CWE-20 | Критическая9,8 | — | 11,8 % | 4 окт. 2019 г. |
52В плане | CVE-2019-16891Proof of concept | Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.liferay · liferay portal · CWE-502 | Критическая9,8 | — | 44,7 % | 4 окт. 2019 г. |
33Наблюдать | CVE-2019-17199Готовый эксплойт | www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regulawebpagetest · webpagetest · CWE-22 | Высокая7,5 | — | 9,9 % | 5 окт. 2019 г. |
51В плане | CVE-2019-17240Proof of concept | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-bludit · bludit · CWE-307 | Критическая9,8 | — | 39,5 % | 6 окт. 2019 г. |
33Наблюдать | CVE-2019-17187Эксплойта нет | /var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for refiberhome · hg2201t firmware · CWE-22 | Высокая7,5 | — | 10,7 % | 8 окт. 2019 г. |
31Наблюдать | CVE-2019-10969Proof of concept | Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on themoxa · edr-810 firmware · CWE-20 | Высокая7,2 | — | 10,6 % | 8 окт. 2019 г. |
39Наблюдать | CVE-2019-13051Proof of concept | Pi-Hole 4.3 allows Command Injection.pi-hole · pi-hole · CWE-78 | Высокая8,8 | — | 12,4 % | 9 окт. 2019 г. |
52В плане | CVE-2019-17382Proof of concept | An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.zabbix · zabbix · CWE-639 | Критическая9,1 | — | 54,1 % | 9 окт. 2019 г. |
49В плане | CVE-2019-15226Эксплойта нет | Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headenvoyproxy · envoy · CWE-400 | Высокая7,5 | — | 64,5 % | 9 окт. 2019 г. |
48В плане | CVE-2019-15859Proof of concept | Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a devisocomec · diris a-40 firmware · CWE-200 | Критическая9,8 | — | 31,4 % | 9 окт. 2019 г. |
46В плане | CVE-2019-17124Proof of concept | Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.kramerav · viaware · CWE-276 | Критическая9,8 | — | 22,5 % | 9 окт. 2019 г. |
37Наблюдать | CVE-2019-15715Proof of concept | MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.mantisbt · mantisbt · CWE-78 | Высокая7,2 | — | 30,0 % | 9 окт. 2019 г. |
43В плане | CVE-2019-17418Proof of concept | An issue was discovered in MetInfo 7.0.metinfo · metinfo · CWE-89 | Высокая7,2 | — | 49,2 % | 9 окт. 2019 г. |
39Наблюдать | CVE-2019-1060Эксплойта нет | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Codemicrosoft · windows 10 · CWE-611 | Высокая8,8 | — | 13,7 % | 10 окт. 2019 г. |
43В плане | CVE-2019-1166Эксплойта нет | A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Messagemicrosoft · windows 10 · CWE-354 | Средняя5,9 | — | 68,1 % | 10 окт. 2019 г. |
33Наблюдать | CVE-2019-1307Эксплойта нет | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Cmicrosoft · chakracore · CWE-787 | Высокая7,5 | — | 10,1 % | 10 окт. 2019 г. |
33Наблюдать | CVE-2019-1308Эксплойта нет | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Cmicrosoft · chakracore · CWE-787 | Высокая7,5 | — | 10,1 % | 10 окт. 2019 г. |
42В плане | CVE-2019-1311Эксплойта нет | A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory, aka 'Windows Imaging API Remmicrosoft · windows 10 | Высокая7,8 | — | 36,2 % | 10 окт. 2019 г. |
62На этой неделе | CVE-2019-1315Готовый эксплойт | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reportmicrosoft · windows 10 1607 · CWE-59 | Высокая7,8 | KEV | 3,4 % | 10 окт. 2019 г. |
67На этой неделе | CVE-2019-1322Готовый эксплойт | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of microsoft · windows 10 1803 | Высокая7,8 | KEV | 19,2 % | 10 окт. 2019 г. |
39Наблюдать | CVE-2019-1327Эксплойта нет | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'microsoft · excel | Высокая8,8 | — | 13,9 % | 10 окт. 2019 г. |
41В плане | CVE-2019-1331Эксплойта нет | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'microsoft · excel | Высокая8,8 | — | 19,7 % | 10 окт. 2019 г. |
40В плане | CVE-2019-1333Эксплойта нет | A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Demicrosoft · windows 10 | Высокая8,8 | — | 15,8 % | 10 окт. 2019 г. |
29Наблюдать | CVE-2019-1343Proof of concept | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.microsoft · windows 10 | Средняя6,5 | — | 10,9 % | 10 окт. 2019 г. |
29Наблюдать | CVE-2019-1346Proof of concept | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.microsoft · windows 10 · CWE-125 | Средняя6,5 | — | 10,9 % | 10 окт. 2019 г. |
30Наблюдать | CVE-2019-1347Proof of concept | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.microsoft · windows 10 · CWE-125 | Средняя6,5 | — | 14,9 % | 10 окт. 2019 г. |
54В плане | CVE-2019-1358Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 75,9 % | 10 окт. 2019 г. |
37Наблюдать | CVE-2019-1359Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 19,2 % | 10 окт. 2019 г. |
46В плане | CVE-2019-1372Эксплойта нет | An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to microsoft · azure app service on azure stack | Критическая10,0 | — | 18,5 % | 10 окт. 2019 г. |
34Наблюдать | CVE-2015-9480Proof of concept | The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.robot-cpa · robotcpa · CWE-22 | Высокая7,5 | — | 12,7 % | 10 окт. 2019 г. |
35Наблюдать | CVE-2019-17503Proof of concept | An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5.kirona · dynamic resource scheduling · CWE-425 | Средняя5,3 | — | 48,3 % | 11 окт. 2019 г. |
83Срочно | CVE-2019-2215Готовый эксплойт | A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.google · android · CWE-416 | Высокая7,8 | KEV | 72,1 % | 11 окт. 2019 г. |
56В плане | CVE-2019-17506Proof of concept | There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers.dlink · dir-868l b1 firmware · CWE-306 | Критическая9,8 | — | 56,3 % | 11 окт. 2019 г. |
44В плане | CVE-2019-17508Готовый эксплойт | On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable.dlink · dir-859 a3 firmware · CWE-78 | Критическая9,8 | — | 15,8 % | 11 окт. 2019 г. |
35Наблюдать | CVE-2017-18638Proof of concept | send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF.graphite project · graphite · CWE-918 | Высокая7,5 | — | 15,3 % | 11 окт. 2019 г. |
33Наблюдать | CVE-2019-17538Proof of concept | Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substringjnoj · jiangnan online judge · CWE-22 | Высокая7,5 | — | 11,3 % | 13 окт. 2019 г. |
99Срочно | CVE-2019-16278Готовый эксплойт | Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a cnazgul · nostromo nhttpd · CWE-22 | Критическая9,8 | KEV | 99,0 % | 14 окт. 2019 г. |
36Наблюдать | CVE-2019-16279Proof of concept | A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted Hnazgul · nostromo nhttpd · CWE-22 | Высокая7,5 | — | 19,8 % | 14 окт. 2019 г. |
42В плане | CVE-2019-17195Proof of concept | Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crashconnect2id · nimbus jose\+jwt · CWE-755 | Критическая9,8 | — | 11,1 % | 15 окт. 2019 г. |
63На этой неделе | CVE-2019-17602Эксплойта нет | An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089.zohocorp · manageengine opmanager · CWE-89 | Критическая9,8 | — | 81,0 % | 15 окт. 2019 г. |
42В плане | CVE-2019-17626Эксплойта нет | ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document reportlab · reportlab · CWE-91 | Критическая9,8 | — | 10,2 % | 16 окт. 2019 г. |
68На этой неделе | CVE-2019-17662Готовый эксплойт | ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server.cybelsoft · thinvnc · CWE-22 | Критическая9,8 | — | 96,7 % | 16 окт. 2019 г. |
39Наблюдать | CVE-2019-2890Proof of concept | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).oracle · weblogic server | Высокая7,2 | — | 36,5 % | 16 окт. 2019 г. |
43В плане | CVE-2019-2904Эксплойта нет | Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces).oracle · application testing suite | Критическая9,8 | — | 14,2 % | 16 окт. 2019 г. |
69На этой неделе | CVE-2019-3010Готовый эксплойт | Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver).oracle · solaris | Высокая8,8 | KEV | 13,3 % | 16 окт. 2019 г. |
40В плане | CVE-2019-3025Proof of concept | Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications.oracle · hospitality res 3700 | Критическая9,0 | — | 14,4 % | 16 окт. 2019 г. |
32Наблюдать | CVE-2019-17671Proof of concept | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.wordpress · wordpress · CWE-200 | Средняя5,3 | — | 36,5 % | 17 окт. 2019 г. |
41В плане | CVE-2019-14423Эксплойта нет | A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote autheq-3 · cux-daemon · CWE-78 | Высокая8,8 | — | 19,8 % | 17 окт. 2019 г. |
40В плане | CVE-2019-15850Эксплойта нет | eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method.eq-3 · homematic ccu3 firmware · CWE-862 | Высокая8,8 | — | 15,5 % | 17 окт. 2019 г. |
38Наблюдать | CVE-2019-11253Proof of concept | Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attackkubernetes · kubernetes · CWE-20 | Высокая7,5 | — | 25,9 % | 17 окт. 2019 г. |
54В плане | CVE-2019-14287Proof of concept | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, asudo project · sudo · CWE-755 | Высокая8,8 | — | 63,7 % | 17 окт. 2019 г. |
39Наблюдать | CVE-2019-17120Эксплойта нет | A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers towikidsystems · 2fa enterprise server · CWE-79 | Средняя6,1 | — | 48,9 % | 17 окт. 2019 г. |
39Наблюдать | CVE-2019-8183Эксплойта нет | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and eadobe · acrobat dc · CWE-787 | Высокая8,8 | — | 13,0 % | 17 окт. 2019 г. |
46В плане | CVE-2019-8195Proof of concept | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and eadobe · acrobat dc · CWE-119 | Критическая9,8 | — | 22,8 % | 17 окт. 2019 г. |
46В плане | CVE-2019-8196Proof of concept | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and eadobe · acrobat dc · CWE-119 | Критическая9,8 | — | 22,8 % | 17 окт. 2019 г. |
44В плане | CVE-2019-8197Proof of concept | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and eadobe · acrobat dc · CWE-787 | Критическая9,8 | — | 16,8 % | 17 окт. 2019 г. |
36Наблюдать | CVE-2019-18217Proof of concept | ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long cproftpd · proftpd · CWE-835 | Высокая7,5 | — | 20,2 % | 21 окт. 2019 г. |
35Наблюдать | CVE-2019-9491Proof of concept | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious filtrendmicro · anti-threat toolkit · CWE-427 | Высокая7,8 | — | 12,9 % | 21 окт. 2019 г. |
35Наблюдать | CVE-2019-17424Proof of concept | A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (servnipper-ng project · nipper-ng · CWE-787 | Высокая7,8 | — | 13,4 % | 22 окт. 2019 г. |
44В плане | CVE-2015-9499Proof of concept | The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.themepunch · showbiz pro · CWE-434 | Критическая9,8 | — | 16,2 % | 22 окт. 2019 г. |
41В плане | CVE-2019-10475Proof of concept | A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript intojenkins · build-metrics · CWE-79 | Средняя6,1 | — | 57,7 % | 23 окт. 2019 г. |
33Наблюдать | CVE-2019-18277Эксплойта нет | A flaw was found in HAProxy before 2.0.6.haproxy · haproxy · CWE-444 | Высокая7,5 | — | 10,0 % | 23 окт. 2019 г. |
51В плане | CVE-2019-18370Proof of concept | An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.mi · millet router 3g firmware · CWE-78 | Критическая9,8 | — | 40,2 % | 23 окт. 2019 г. |
47В плане | CVE-2019-18371Proof of concept | An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.mi · millet router 3g firmware · CWE-22 | Высокая7,5 | — | 55,8 % | 23 окт. 2019 г. |
25Наблюдать | CVE-2019-18393Proof of concept | PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directigniterealtime · openfire · CWE-22 | Средняя5,3 | — | 13,9 % | 24 окт. 2019 г. |
49В плане | CVE-2019-18394Proof of concept | A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to sendigniterealtime · openfire · CWE-918 | Критическая9,8 | — | 32,3 % | 24 окт. 2019 г. |
37Наблюдать | CVE-2019-8086Proof of concept | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability.adobe · experience manager · CWE-611 | Высокая7,5 | — | 22,5 % | 25 окт. 2019 г. |
53В плане | CVE-2019-5127Proof of concept | A command injection have been found in YouPHPTube Encoder.youphptube · youphptube encoder · CWE-78 | Критическая9,8 | — | 45,3 % | 25 окт. 2019 г. |
48В плане | CVE-2019-5128Proof of concept | A command injection have been found in YouPHPTube Encoder.youphptube · youphptube encoder · CWE-78 | Критическая9,8 | — | 30,1 % | 25 окт. 2019 г. |
51В плане | CVE-2019-5129Proof of concept | A command injection have been found in YouPHPTube Encoder.youphptube · youphptube encoder · CWE-78 | Критическая9,8 | — | 38,5 % | 25 окт. 2019 г. |
68На этой неделе | CVE-2019-16662Готовый эксплойт | An issue was discovered in rConfig 3.9.2.rconfig · rconfig · CWE-78 | Критическая9,8 | — | 97,7 % | 28 окт. 2019 г. |
60На этой неделе | CVE-2019-16663Proof of concept | An issue was discovered in rConfig 3.9.2.rconfig · rconfig · CWE-78 | Высокая8,8 | — | 84,6 % | 28 окт. 2019 г. |
42В плане | CVE-2019-14927Proof of concept | An issue was discovered on Mitsubishi Electric Europe B.V.mitsubishielectric · smartrtu firmware · CWE-306 | Высокая7,5 | — | 40,8 % | 28 окт. 2019 г. |
34Наблюдать | CVE-2019-14928Эксплойта нет | An issue was discovered on Mitsubishi Electric Europe B.V.mitsubishielectric · smartrtu firmware · CWE-79 | Средняя5,4 | — | 43,1 % | 28 окт. 2019 г. |
56В плане | CVE-2019-14931Proof of concept | An issue was discovered on Mitsubishi Electric Europe B.V.mitsubishielectric · smartrtu firmware · CWE-78 | Критическая9,8 | — | 57,3 % | 28 окт. 2019 г. |
43В плане | CVE-2010-4239Proof of concept | Tiki Wiki CMS Groupware 5.2 has Local File Inclusiontiki · tikiwiki cms\/groupware · CWE-20 | Критическая9,8 | — | 13,4 % | 28 окт. 2019 г. |
99Срочно | CVE-2019-11043Готовый эксплойт | Underflow in PHP-FPM can lead to RCEphp · php · CWE-120 | Критическая9,8 | KEV | 99,7 % | 28 окт. 2019 г. |
42В плане | CVE-2019-14450Proof of concept | A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation ofrepetier-server · repetier-server · CWE-22 | Критическая9,8 | — | 10,4 % | 28 окт. 2019 г. |
53В плане | CVE-2019-17181Готовый эксплойт | A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03).intrasrv project · intrasrv · CWE-120 | Критическая9,8 | — | 47,6 % | 28 окт. 2019 г. |
68На этой неделе | CVE-2019-18187Готовый эксплойт | Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extractrendmicro · officescan · CWE-22 | Высокая7,5 | KEV | 25,1 % | 28 окт. 2019 г. |
43В плане | CVE-2019-15678Эксплойта нет | TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution..tightvnc · tightvnc · CWE-122 | Критическая9,8 | — | 12,8 % | 29 окт. 2019 г. |
43В плане | CVE-2019-15679Эксплойта нет | TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution.tightvnc · tightvnc · CWE-122 | Критическая9,8 | — | 11,8 % | 29 окт. 2019 г. |
45В плане | CVE-2019-15683Эксплойта нет | TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e.turbovnc · turbovnc · CWE-121 | Критическая9,8 | — | 19,3 % | 29 окт. 2019 г. |
33Наблюдать | CVE-2019-3978Proof of concept | RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291.mikrotik · routeros · CWE-306 | Высокая7,5 | — | 10,2 % | 29 окт. 2019 г. |
22Наблюдать | CVE-2019-5533Эксплойта нет | In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterpvmware · sd-wan by velocloud · CWE-863 | Средняя4,3 | — | 17,3 % | 29 окт. 2019 г. |
26Наблюдать | CVE-2019-6841Эксплойта нет | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon schneider-electric · modicon m580 firmware · CWE-755 | Средняя4,9 | — | 23,7 % | 29 окт. 2019 г. |
44В плане | CVE-2019-6848Эксплойта нет | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication modschneider-electric · modicon m580 firmware · CWE-755 | Высокая8,6 | — | 32,1 % | 29 окт. 2019 г. |
39Наблюдать | CVE-2019-6851Эксплойта нет | A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (alschneider-electric · modicon m580 firmware · CWE-538 | Высокая7,5 | — | 29,1 % | 29 окт. 2019 г. |
45В плане | CVE-2019-8287Эксплойта нет | TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution.tightvnc · tightvnc · CWE-120 | Критическая9,8 | — | 19,4 % | 29 окт. 2019 г. |
41В плане | CVE-2019-9757Proof of concept | An issue was discovered in LabKey Server 19.1.0.labkey · labkey server · CWE-611 | Высокая7,5 | — | 37,3 % | 29 окт. 2019 г. |
59В плане | CVE-2012-0694Готовый эксплойт | SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrarysugarcrm · sugarcrm · CWE-20 | Критическая9,8 | — | 67,2 % | 29 окт. 2019 г. |
53В плане | CVE-2013-1391Готовый эксплойт | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR syshachi · hv-04rd pro firmware · CWE-287 | Высокая7,5 | — | 76,1 % | 30 окт. 2019 г. |
33Наблюдать | CVE-2019-18396Proof of concept | An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices.technicolor · td5130v2 firmware · CWE-78 | Высокая7,2 | — | 16,2 % | 31 окт. 2019 г. |
32Наблюдать | CVE-2018-4064Эксплойта нет | An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 Fsierrawireless · airlink es450 firmware · CWE-287 | Высокая7,1 | — | 14,4 % | 31 окт. 2019 г. |
36Наблюдать | CVE-2019-5010Proof of concept | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.python · python · CWE-476 | Высокая7,5 | — | 20,7 % | 31 окт. 2019 г. |
- CVE-2019-1503943В плане
An issue was discovered in JetBrains TeamCity 2018.2.4.
КритическаяCVSS 9,8Proof of conceptEPSS 12 %jetbrains · teamcity1 окт. 2019 г.
- CVE-2019-1263059В плане
Cisco Security Manager Java Deserialization Vulnerability
КритическаяCVSS 9,8Эксплойта нетEPSS 65 %cisco · security manager2 окт. 2019 г.
- CVE-2019-1632834Наблюдать
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c
ВысокаяCVSS 7,5Готовый эксплойтEPSS 13 %rpyc project · rpyc3 окт. 2019 г.
- CVE-2019-1193248В плане
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in W
ВысокаяCVSS 8,8Proof of conceptEPSS 44 %whatsapp · whatsapp3 окт. 2019 г.
- CVE-2019-1713243В плане
vBulletin through 5.5.4 mishandles custom avatars.
КритическаяCVSS 9,8Proof of conceptEPSS 11 %vbulletin · vbulletin4 окт. 2019 г.
- CVE-2019-1689152В плане
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
КритическаяCVSS 9,8Proof of conceptEPSS 44 %liferay · liferay portal4 окт. 2019 г.
- CVE-2019-1719933Наблюдать
www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regula
ВысокаяCVSS 7,5Готовый эксплойтEPSS 9 %webpagetest · webpagetest5 окт. 2019 г.
- CVE-2019-1724051В плане
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-
КритическаяCVSS 9,8Proof of conceptEPSS 39 %bludit · bludit6 окт. 2019 г.
- CVE-2019-1718733Наблюдать
/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for re
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %fiberhome · hg2201t firmware8 окт. 2019 г.
- CVE-2019-1096931Наблюдать
Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the
ВысокаяCVSS 7,2Proof of conceptEPSS 10 %moxa · edr-810 firmware8 окт. 2019 г.
- CVE-2019-1305139Наблюдать
Pi-Hole 4.3 allows Command Injection.
ВысокаяCVSS 8,8Proof of conceptEPSS 12 %pi-hole · pi-hole9 окт. 2019 г.
- CVE-2019-1738252В плане
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.
КритическаяCVSS 9,1Proof of conceptEPSS 54 %zabbix · zabbix9 окт. 2019 г.
- CVE-2019-1522649В плане
Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the head
ВысокаяCVSS 7,5Эксплойта нетEPSS 64 %envoyproxy · envoy9 окт. 2019 г.
- CVE-2019-1585948В плане
Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a devi
КритическаяCVSS 9,8Proof of conceptEPSS 31 %socomec · diris a-40 firmware9 окт. 2019 г.
- CVE-2019-1712446В плане
Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
КритическаяCVSS 9,8Proof of conceptEPSS 22 %kramerav · viaware9 окт. 2019 г.
- CVE-2019-1571537Наблюдать
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
ВысокаяCVSS 7,2Proof of conceptEPSS 30 %mantisbt · mantisbt9 окт. 2019 г.
- CVE-2019-1741843В плане
An issue was discovered in MetInfo 7.0.
ВысокаяCVSS 7,2Proof of conceptEPSS 49 %metinfo · metinfo9 окт. 2019 г.
- CVE-2019-106039Наблюдать
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-116643В плане
A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message
СредняяCVSS 5,9Эксплойта нетEPSS 68 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-130733Наблюдать
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %microsoft · chakracore10 окт. 2019 г.
- CVE-2019-130833Наблюдать
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %microsoft · chakracore10 окт. 2019 г.
- CVE-2019-131142В плане
A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory, aka 'Windows Imaging API Rem
ВысокаяCVSS 7,8Эксплойта нетEPSS 36 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-131562На этой неделе
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Report
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 3 %microsoft · windows 10 160710 окт. 2019 г.
- CVE-2019-132267На этой неделе
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 19 %microsoft · windows 10 180310 окт. 2019 г.
- CVE-2019-132739Наблюдать
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %microsoft · excel10 окт. 2019 г.
- CVE-2019-133141В плане
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '
ВысокаяCVSS 8,8Эксплойта нетEPSS 19 %microsoft · excel10 окт. 2019 г.
- CVE-2019-133340В плане
A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De
ВысокаяCVSS 8,8Эксплойта нетEPSS 15 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-134329Наблюдать
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.
СредняяCVSS 6,5Proof of conceptEPSS 10 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-134629Наблюдать
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.
СредняяCVSS 6,5Proof of conceptEPSS 10 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-134730Наблюдать
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.
СредняяCVSS 6,5Proof of conceptEPSS 14 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-135854В плане
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 75 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-135937Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %microsoft · windows 1010 окт. 2019 г.
- CVE-2019-137246В плане
An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to
КритическаяCVSS 10,0Эксплойта нетEPSS 18 %microsoft · azure app service on azure stack10 окт. 2019 г.
- CVE-2015-948034Наблюдать
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.
ВысокаяCVSS 7,5Proof of conceptEPSS 12 %robot-cpa · robotcpa10 окт. 2019 г.
- CVE-2019-1750335Наблюдать
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5.
СредняяCVSS 5,3Proof of conceptEPSS 48 %kirona · dynamic resource scheduling11 окт. 2019 г.
- CVE-2019-221583Срочно
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 72 %google · android11 окт. 2019 г.
- CVE-2019-1750656В плане
There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers.
КритическаяCVSS 9,8Proof of conceptEPSS 56 %dlink · dir-868l b1 firmware11 окт. 2019 г.
- CVE-2019-1750844В плане
On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable.
КритическаяCVSS 9,8Готовый эксплойтEPSS 15 %dlink · dir-859 a3 firmware11 окт. 2019 г.
- CVE-2017-1863835Наблюдать
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF.
ВысокаяCVSS 7,5Proof of conceptEPSS 15 %graphite project · graphite11 окт. 2019 г.
- CVE-2019-1753833Наблюдать
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %jnoj · jiangnan online judge13 окт. 2019 г.
- CVE-2019-1627899Срочно
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %nazgul · nostromo nhttpd14 окт. 2019 г.
- CVE-2019-1627936Наблюдать
A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted H
ВысокаяCVSS 7,5Proof of conceptEPSS 19 %nazgul · nostromo nhttpd14 окт. 2019 г.
- CVE-2019-1719542В плане
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash
КритическаяCVSS 9,8Proof of conceptEPSS 11 %connect2id · nimbus jose\+jwt15 окт. 2019 г.
- CVE-2019-1760263На этой неделе
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089.
КритическаяCVSS 9,8Эксплойта нетEPSS 81 %zohocorp · manageengine opmanager15 окт. 2019 г.
- CVE-2019-1762642В плане
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %reportlab · reportlab16 окт. 2019 г.
- CVE-2019-1766268На этой неделе
ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server.
КритическаяCVSS 9,8Готовый эксплойтEPSS 96 %cybelsoft · thinvnc16 окт. 2019 г.
- CVE-2019-289039Наблюдать
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).
ВысокаяCVSS 7,2Proof of conceptEPSS 36 %oracle · weblogic server16 окт. 2019 г.
- CVE-2019-290443В плане
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces).
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %oracle · application testing suite16 окт. 2019 г.
- CVE-2019-301069На этой неделе
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver).
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 13 %oracle · solaris16 окт. 2019 г.
- CVE-2019-302540В плане
Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications.
КритическаяCVSS 9,0Proof of conceptEPSS 14 %oracle · hospitality res 370016 окт. 2019 г.
- CVE-2019-1767132Наблюдать
In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
СредняяCVSS 5,3Proof of conceptEPSS 36 %wordpress · wordpress17 окт. 2019 г.
- CVE-2019-1442341В плане
A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote auth
ВысокаяCVSS 8,8Эксплойта нетEPSS 19 %eq-3 · cux-daemon17 окт. 2019 г.
- CVE-2019-1585040В плане
eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method.
ВысокаяCVSS 8,8Эксплойта нетEPSS 15 %eq-3 · homematic ccu3 firmware17 окт. 2019 г.
- CVE-2019-1125338Наблюдать
Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack
ВысокаяCVSS 7,5Proof of conceptEPSS 25 %kubernetes · kubernetes17 окт. 2019 г.
- CVE-2019-1428754В плане
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, a
ВысокаяCVSS 8,8Proof of conceptEPSS 63 %sudo project · sudo17 окт. 2019 г.
- CVE-2019-1712039Наблюдать
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to
СредняяCVSS 6,1Эксплойта нетEPSS 48 %wikidsystems · 2fa enterprise server17 окт. 2019 г.
- CVE-2019-818339Наблюдать
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %adobe · acrobat dc17 окт. 2019 г.
- CVE-2019-819546В плане
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e
КритическаяCVSS 9,8Proof of conceptEPSS 22 %adobe · acrobat dc17 окт. 2019 г.
- CVE-2019-819646В плане
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e
КритическаяCVSS 9,8Proof of conceptEPSS 22 %adobe · acrobat dc17 окт. 2019 г.
- CVE-2019-819744В плане
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e
КритическаяCVSS 9,8Proof of conceptEPSS 16 %adobe · acrobat dc17 окт. 2019 г.
- CVE-2019-1821736Наблюдать
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long c
ВысокаяCVSS 7,5Proof of conceptEPSS 20 %proftpd · proftpd21 окт. 2019 г.
- CVE-2019-949135Наблюдать
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious fil
ВысокаяCVSS 7,8Proof of conceptEPSS 12 %trendmicro · anti-threat toolkit21 окт. 2019 г.
- CVE-2019-1742435Наблюдать
A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serv
ВысокаяCVSS 7,8Proof of conceptEPSS 13 %nipper-ng project · nipper-ng22 окт. 2019 г.
- CVE-2015-949944В плане
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.
КритическаяCVSS 9,8Proof of conceptEPSS 16 %themepunch · showbiz pro22 окт. 2019 г.
- CVE-2019-1047541В плане
A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into
СредняяCVSS 6,1Proof of conceptEPSS 57 %jenkins · build-metrics23 окт. 2019 г.
- CVE-2019-1827733Наблюдать
A flaw was found in HAProxy before 2.0.6.
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %haproxy · haproxy23 окт. 2019 г.
- CVE-2019-1837051В плане
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.
КритическаяCVSS 9,8Proof of conceptEPSS 40 %mi · millet router 3g firmware23 окт. 2019 г.
- CVE-2019-1837147В плане
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.
ВысокаяCVSS 7,5Proof of conceptEPSS 55 %mi · millet router 3g firmware23 окт. 2019 г.
- CVE-2019-1839325Наблюдать
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct
СредняяCVSS 5,3Proof of conceptEPSS 13 %igniterealtime · openfire24 окт. 2019 г.
- CVE-2019-1839449В плане
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send
КритическаяCVSS 9,8Proof of conceptEPSS 32 %igniterealtime · openfire24 окт. 2019 г.
- CVE-2019-808637Наблюдать
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability.
ВысокаяCVSS 7,5Proof of conceptEPSS 22 %adobe · experience manager25 окт. 2019 г.
- CVE-2019-512753В плане
A command injection have been found in YouPHPTube Encoder.
КритическаяCVSS 9,8Proof of conceptEPSS 45 %youphptube · youphptube encoder25 окт. 2019 г.
- CVE-2019-512848В плане
A command injection have been found in YouPHPTube Encoder.
КритическаяCVSS 9,8Proof of conceptEPSS 30 %youphptube · youphptube encoder25 окт. 2019 г.
- CVE-2019-512951В плане
A command injection have been found in YouPHPTube Encoder.
КритическаяCVSS 9,8Proof of conceptEPSS 38 %youphptube · youphptube encoder25 окт. 2019 г.
- CVE-2019-1666268На этой неделе
An issue was discovered in rConfig 3.9.2.
КритическаяCVSS 9,8Готовый эксплойтEPSS 97 %rconfig · rconfig28 окт. 2019 г.
- CVE-2019-1666360На этой неделе
An issue was discovered in rConfig 3.9.2.
ВысокаяCVSS 8,8Proof of conceptEPSS 84 %rconfig · rconfig28 окт. 2019 г.
- CVE-2019-1492742В плане
An issue was discovered on Mitsubishi Electric Europe B.V.
ВысокаяCVSS 7,5Proof of conceptEPSS 40 %mitsubishielectric · smartrtu firmware28 окт. 2019 г.
- CVE-2019-1492834Наблюдать
An issue was discovered on Mitsubishi Electric Europe B.V.
СредняяCVSS 5,4Эксплойта нетEPSS 43 %mitsubishielectric · smartrtu firmware28 окт. 2019 г.
- CVE-2019-1493156В плане
An issue was discovered on Mitsubishi Electric Europe B.V.
КритическаяCVSS 9,8Proof of conceptEPSS 57 %mitsubishielectric · smartrtu firmware28 окт. 2019 г.
- CVE-2010-423943В плане
Tiki Wiki CMS Groupware 5.2 has Local File Inclusion
КритическаяCVSS 9,8Proof of conceptEPSS 13 %tiki · tikiwiki cms\/groupware28 окт. 2019 г.
- CVE-2019-1104399Срочно
Underflow in PHP-FPM can lead to RCE
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %php · php28 окт. 2019 г.
- CVE-2019-1445042В плане
A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of
КритическаяCVSS 9,8Proof of conceptEPSS 10 %repetier-server · repetier-server28 окт. 2019 г.
- CVE-2019-1718153В плане
A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03).
КритическаяCVSS 9,8Готовый эксплойтEPSS 47 %intrasrv project · intrasrv28 окт. 2019 г.
- CVE-2019-1818768На этой неделе
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extrac
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 25 %trendmicro · officescan28 окт. 2019 г.
- CVE-2019-1567843В плане
TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution..
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %tightvnc · tightvnc29 окт. 2019 г.
- CVE-2019-1567943В плане
TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution.
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %tightvnc · tightvnc29 окт. 2019 г.
- CVE-2019-1568345В плане
TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e.
КритическаяCVSS 9,8Эксплойта нетEPSS 19 %turbovnc · turbovnc29 окт. 2019 г.
- CVE-2019-397833Наблюдать
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291.
ВысокаяCVSS 7,5Proof of conceptEPSS 10 %mikrotik · routeros29 окт. 2019 г.
- CVE-2019-553322Наблюдать
In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterp
СредняяCVSS 4,3Эксплойта нетEPSS 17 %vmware · sd-wan by velocloud29 окт. 2019 г.
- CVE-2019-684126Наблюдать
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon
СредняяCVSS 4,9Эксплойта нетEPSS 23 %schneider-electric · modicon m580 firmware29 окт. 2019 г.
- CVE-2019-684844В плане
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication mod
ВысокаяCVSS 8,6Эксплойта нетEPSS 32 %schneider-electric · modicon m580 firmware29 окт. 2019 г.
- CVE-2019-685139Наблюдать
A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (al
ВысокаяCVSS 7,5Эксплойта нетEPSS 29 %schneider-electric · modicon m580 firmware29 окт. 2019 г.
- CVE-2019-828745В плане
TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution.
КритическаяCVSS 9,8Эксплойта нетEPSS 19 %tightvnc · tightvnc29 окт. 2019 г.
- CVE-2019-975741В плане
An issue was discovered in LabKey Server 19.1.0.
ВысокаяCVSS 7,5Proof of conceptEPSS 37 %labkey · labkey server29 окт. 2019 г.
- CVE-2012-069459В плане
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary
КритическаяCVSS 9,8Готовый эксплойтEPSS 67 %sugarcrm · sugarcrm29 окт. 2019 г.
- CVE-2013-139153В плане
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR sys
ВысокаяCVSS 7,5Готовый эксплойтEPSS 76 %hachi · hv-04rd pro firmware30 окт. 2019 г.
- CVE-2019-1839633Наблюдать
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices.
ВысокаяCVSS 7,2Proof of conceptEPSS 16 %technicolor · td5130v2 firmware31 окт. 2019 г.
- CVE-2018-406432Наблюдать
An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 F
ВысокаяCVSS 7,1Эксплойта нетEPSS 14 %sierrawireless · airlink es450 firmware31 окт. 2019 г.
- CVE-2019-501036Наблюдать
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.
ВысокаяCVSS 7,5Proof of conceptEPSS 20 %python · python31 окт. 2019 г.