Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: январь 2020 г.

119 записей · 7 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

Страница 1 из 2

  • CVE-2013-3619
    60На этой неделе

    Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for

    ВысокаяCVSS 8,1Готовый эксплойтEPSS 9 %

    supermicro · smt x9 firmware2 янв. 2020 г.

  • CVE-2013-3944
    39Наблюдать

    Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via

    ВысокаяCVSS 7,8Эксплойта нетEPSS 27 %

    extensis · mrsid2 янв. 2020 г.

  • CVE-2016-1000027
    49В плане

    Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untru

    КритическаяCVSS 9,8Proof of conceptEPSS 33 %

    vmware · spring framework2 янв. 2020 г.

  • CVE-2019-5063
    41В плане

    An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0.

    ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %

    opencv · opencv3 янв. 2020 г.

  • CVE-2019-5064
    38Наблюдать

    An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0.

    ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %

    opencv · opencv3 янв. 2020 г.

  • CVE-2014-8516
    64На этой неделе

    Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a fi

    КритическаяCVSS 9,8Готовый эксплойтEPSS 81 %

    cloudfastpath · netcharts server3 янв. 2020 г.

  • CVE-2020-5192
    42В плане

    PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not

    ВысокаяCVSS 8,8Proof of conceptEPSS 23 %

    phpgurukul · hospital management system5 янв. 2020 г.

  • CVE-2019-15975
    68На этой неделе

    Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

    КритическаяCVSS 9,8Готовый эксплойтEPSS 96 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2019-15976
    67На этой неделе

    Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

    КритическаяCVSS 9,8Proof of conceptEPSS 92 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2019-15977
    41В плане

    Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

    ВысокаяCVSS 7,5Proof of conceptEPSS 38 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2019-15978
    39Наблюдать

    Cisco Data Center Network Manager Command Injection Vulnerabilities

    ВысокаяCVSS 7,2Proof of conceptEPSS 37 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2019-15980
    43В плане

    Cisco Data Center Network Manager Path Traversal Vulnerabilities

    ВысокаяCVSS 7,2Эксплойта нетEPSS 49 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2019-15981
    32Наблюдать

    Cisco Data Center Network Manager Path Traversal Vulnerabilities

    ВысокаяCVSS 7,2Эксплойта нетEPSS 14 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2019-15982
    32Наблюдать

    Cisco Data Center Network Manager Path Traversal Vulnerabilities

    ВысокаяCVSS 7,2Эксплойта нетEPSS 14 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2019-15984
    42В плане

    Cisco Data Center Network Manager SQL Injection Vulnerabilities

    ВысокаяCVSS 7,2Proof of conceptEPSS 46 %

    cisco · data center network manager6 янв. 2020 г.

  • CVE-2020-5514
    49В плане

    Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.

    КритическаяCVSS 9,1Эксплойта нетEPSS 44 %

    gilacms · gila cms6 янв. 2020 г.

  • CVE-2020-5515
    36Наблюдать

    Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.

    ВысокаяCVSS 7,2Proof of conceptEPSS 26 %

    gilacms · gila cms6 янв. 2020 г.

  • CVE-2019-19509
    56В плане

    An issue was discovered in rConfig 3.9.3.

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 71 %

    rconfig · rconfig6 янв. 2020 г.

  • CVE-2020-5512
    33Наблюдать

    Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.

    СредняяCVSS 6,8Эксплойта нетEPSS 18 %

    gilacms · gila cms6 янв. 2020 г.

  • CVE-2020-5513
    35Наблюдать

    Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.

    СредняяCVSS 6,8Эксплойта нетEPSS 25 %

    gilacms · gila cms6 янв. 2020 г.

  • CVE-2015-4553
    52В плане

    A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.

    ВысокаяCVSS 8,8Proof of conceptEPSS 56 %

    dedecms · dedecms6 янв. 2020 г.

  • CVE-2014-8673
    43В плане

    Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Plann

    КритическаяCVSS 9,8Proof of conceptEPSS 11 %

    soplanning · soplanning7 янв. 2020 г.

  • CVE-2020-5307
    44В плане

    PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    phpgurukul · dairy farm shop management system7 янв. 2020 г.

  • CVE-2019-17147
    39Наблюдать

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers.

    ВысокаяCVSS 8,8Proof of conceptEPSS 13 %

    tp-link · tl-wr841n firmware7 янв. 2020 г.

  • CVE-2019-20361
    65На этой неделе

    There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the data

    КритическаяCVSS 9,8Готовый эксплойтEPSS 85 %

    icegram · email subscribers \& newsletters8 янв. 2020 г.

  • CVE-2019-19494
    60На этой неделе

    Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 23 %

    sagemcom · f\@st 3890 firmware9 янв. 2020 г.

  • CVE-2019-20224
    50В плане

    netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell

    ВысокаяCVSS 8,8Proof of conceptEPSS 49 %

    artica · pandora fms9 янв. 2020 г.

  • CVE-2019-20372
    25Наблюдать

    NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to

    СредняяCVSS 5,3Proof of conceptEPSS 14 %

    f5 · nginx9 янв. 2020 г.

  • CVE-2012-3807
    48В плане

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.

    КритическаяCVSS 9,8Proof of conceptEPSS 31 %

    samsung · kies9 янв. 2020 г.

  • CVE-2020-5504
    47В плане

    In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page.

    ВысокаяCVSS 8,8Proof of conceptEPSS 39 %

    phpmyadmin · phpmyadmin9 янв. 2020 г.

  • CVE-2020-6756
    42В плане

    languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code

    КритическаяCVSS 9,8Proof of conceptEPSS 10 %

    rasilient · pixelstor 5000 firmware9 янв. 2020 г.

  • CVE-2014-5081
    42В плане

    sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass

    КритическаяCVSS 9,8Proof of conceptEPSS 10 %

    sphider · sphider10 янв. 2020 г.

  • CVE-2012-4284
    60На этой неделе

    A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHe

    КритическаяCVSS 9,8Готовый эксплойтEPSS 69 %

    sparklabs · viscosity10 янв. 2020 г.

  • CVE-2019-13767
    40В плане

    Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to

    ВысокаяCVSS 8,8Эксплойта нетEPSS 15 %

    google · chrome10 янв. 2020 г.

  • CVE-2014-6038
    60На этой неделе

    Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability.

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 72 %

    zohocorp · manageengine eventlog analyzer13 янв. 2020 г.

  • CVE-2014-6039
    60На этой неделе

    ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability.

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 68 %

    zohocorp · manageengine eventlog analyzer13 янв. 2020 г.

  • CVE-2013-6225
    47В плане

    LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability

    КритическаяCVSS 9,8Proof of conceptEPSS 26 %

    livezilla · livezilla13 янв. 2020 г.

  • CVE-2015-3159
    31Наблюдать

    The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process env

    ВысокаяCVSS 7,8Эксплойта нетEPSS 0 %

    redhat · automatic bug reporting tool14 янв. 2020 г.

  • CVE-2020-5505
    52В плане

    Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"applic

    КритическаяCVSS 9,8Эксплойта нетEPSS 44 %

    vaaip · freelancy14 янв. 2020 г.

  • CVE-2020-0601
    89Срочно

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attac

    ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 89 %

    microsoft · windows 10 150714 янв. 2020 г.

  • CVE-2020-0603
    41В плане

    A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who su

    ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %

    microsoft · asp.net core14 янв. 2020 г.

  • CVE-2020-0605
    40В плане

    A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who s

    ВысокаяCVSS 8,8Эксплойта нетEPSS 17 %

    microsoft · .net framework14 янв. 2020 г.

  • CVE-2020-0606
    40В плане

    A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who s

    ВысокаяCVSS 8,8Эксплойта нетEPSS 17 %

    microsoft · .net framework14 янв. 2020 г.

  • CVE-2020-0609
    62На этой неделе

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the

    КритическаяCVSS 9,8Proof of conceptEPSS 77 %

    microsoft · windows server 201214 янв. 2020 г.

  • CVE-2020-0610
    59В плане

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the

    КритическаяCVSS 9,8Proof of conceptEPSS 67 %

    microsoft · windows server 201214 янв. 2020 г.

  • CVE-2020-0638
    62На этой неделе

    An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an at

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 2 %

    microsoft · windows 10 170914 янв. 2020 г.

  • CVE-2020-0646
    99Срочно

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %

    microsoft · .net framework14 янв. 2020 г.

  • CVE-2020-0650
    36Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %

    microsoft · excel14 янв. 2020 г.

  • CVE-2020-0651
    36Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %

    microsoft · excel14 янв. 2020 г.

  • CVE-2020-0652
    36Наблюдать

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %

    microsoft · excel14 янв. 2020 г.

  • CVE-2020-0653
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %

    microsoft · office 365 proplus14 янв. 2020 г.

  • CVE-2015-7874
    43В плане

    Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nick

    КритическаяCVSS 9,8Proof of conceptEPSS 13 %

    portapps · kitty portable15 янв. 2020 г.

  • CVE-2020-2096
    52В плане

    Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerabi

    СредняяCVSS 6,1Proof of conceptEPSS 92 %

    jenkins · gitlab hook15 янв. 2020 г.

  • CVE-2019-16469
    35Наблюдать

    Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability.

    ВысокаяCVSS 7,5Proof of conceptEPSS 17 %

    adobe · experience manager15 янв. 2020 г.

  • CVE-2020-2551
    97Срочно

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components).

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 92 %

    oracle · weblogic server15 янв. 2020 г.

  • CVE-2020-2555
    98Срочно

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 97 %

    oracle · access manager15 янв. 2020 г.

  • CVE-2020-7048
    43В плане

    The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the databas

    КритическаяCVSS 9,1Proof of conceptEPSS 22 %

    webfactoryltd · wp database reset16 янв. 2020 г.

  • CVE-2019-15742
    40В плане

    A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application.

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 4 %

    plantronics · plantronics hub16 янв. 2020 г.

  • CVE-2019-17361
    44В плане

    In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection.

    КритическаяCVSS 9,8Эксплойта нетEPSS 15 %

    saltstack · salt16 янв. 2020 г.

  • CVE-2020-5398
    57В плане

    RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

    ВысокаяCVSS 7,5Proof of conceptEPSS 88 %

    vmware · spring framework17 янв. 2020 г.

  • CVE-2014-5007
    50В плане

    Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Serv

    КритическаяCVSS 9,8Proof of conceptEPSS 37 %

    zohocorp · manageengine desktop central17 янв. 2020 г.

  • CVE-2020-7237
    46В плане

    Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_a

    ВысокаяCVSS 8,8Эксплойта нетEPSS 37 %

    cacti · cacti20 янв. 2020 г.

  • CVE-2020-7246
    60На этой неделе

    A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 83 %

    qdpm · qdpm21 янв. 2020 г.

  • CVE-2019-17357
    36Наблюдать

    Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when

    СредняяCVSS 6,5Эксплойта нетEPSS 34 %

    cacti · cacti21 янв. 2020 г.

  • CVE-2019-18426
    82Срочно

    A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-s

    ВысокаяCVSS 8,2KEVГотовый эксплойтEPSS 67 %

    whatsapp · whatsapp21 янв. 2020 г.

  • CVE-2013-6785
    40В плане

    Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary

    СредняяCVSS 4,3Готовый эксплойтEPSS 4 %

    supermicro · intelligent platform management interface23 янв. 2020 г.

  • CVE-2019-19838
    46В плане

    emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribu

    КритическаяCVSS 9,8Эксплойта нетEPSS 24 %

    ruckuswireless · unleashed23 янв. 2020 г.

  • CVE-2012-6083
    34Наблюдать

    Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.

    ВысокаяCVSS 7,5Proof of conceptEPSS 11 %

    freeciv · freeciv23 янв. 2020 г.

  • CVE-2019-16516
    27Наблюдать

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

    СредняяCVSS 5,3Proof of conceptEPSS 19 %

    connectwise · control23 янв. 2020 г.

  • CVE-2013-1592
    46В плане

    A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Mes

    КритическаяCVSS 9,8Proof of conceptEPSS 24 %

    sap · netweaver23 янв. 2020 г.

  • CVE-2012-6649
    44В плане

    WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    devfarm · wp gpx maps23 янв. 2020 г.

  • CVE-2012-6663
    60На этой неделе

    General Electric D20ME devices are not properly configured and reveal plaintext passwords.

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 9 %

    ge · d20me firmware23 янв. 2020 г.

  • CVE-2019-17570
    54В плане

    An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrp

    КритическаяCVSS 9,8Proof of conceptEPSS 49 %

    apache · xml-rpc23 янв. 2020 г.

  • CVE-2013-1595
    51В плане

    A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization heade

    КритическаяCVSS 9,8Proof of conceptEPSS 41 %

    vivotek · pt7135 firmware24 янв. 2020 г.

  • CVE-2013-1596
    24Наблюдать

    An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554

    СредняяCVSS 5,3Proof of conceptEPSS 10 %

    vivotek · pt7135 firmware24 янв. 2020 г.

  • CVE-2019-19363
    40В плане

    An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege es

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 4 %

    ricoh · generic pcl5 driver24 янв. 2020 г.

  • CVE-2013-1597
    30Наблюдать

    A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let

    СредняяCVSS 6,5Proof of conceptEPSS 14 %

    vivotek · pt7135 firmware24 янв. 2020 г.

  • CVE-2013-1598
    41В плане

    A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary

    ВысокаяCVSS 8,8Proof of conceptEPSS 20 %

    vivotek · pt7135 firmware24 янв. 2020 г.

  • CVE-2019-1349
    45В плане

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    ВысокаяCVSS 8,8Эксплойта нетEPSS 34 %

    microsoft · visual studio 201724 янв. 2020 г.

  • CVE-2019-1350
    43В плане

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    ВысокаяCVSS 8,8Эксплойта нетEPSS 25 %

    microsoft · visual studio 201724 янв. 2020 г.

  • CVE-2019-1352
    42В плане

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    ВысокаяCVSS 8,8Эксплойта нетEPSS 24 %

    microsoft · visual studio 201724 янв. 2020 г.

  • CVE-2019-1354
    42В плане

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    ВысокаяCVSS 8,8Эксплойта нетEPSS 22 %

    microsoft · visual studio 201724 янв. 2020 г.

  • CVE-2020-7980
    64На этой неделе

    Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.c

    КритическаяCVSS 9,8Proof of conceptEPSS 82 %

    intelliantech · aptus web25 янв. 2020 г.

  • CVE-2012-1495
    63На этой неделе

    install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.

    КритическаяCVSS 9,8Готовый эксплойтEPSS 79 %

    webcalendar project · webcalendar27 янв. 2020 г.

  • CVE-2019-19825
    48В плане

    On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/

    КритическаяCVSS 9,8Proof of conceptEPSS 29 %

    totolink · a3002ru firmware27 янв. 2020 г.

  • CVE-2020-7949
    32Наблюдать

    schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming se

    ВысокаяCVSS 7,8Proof of conceptEPSS 4 %

    valvesoftware · dota 227 янв. 2020 г.

  • CVE-2013-7390
    61На этой неделе

    Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remot

    КритическаяCVSS 9,8Готовый эксплойтEPSS 74 %

    zohocorp · manageengine desktop central27 янв. 2020 г.

  • CVE-2014-8741
    62На этой неделе

    Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers

    КритическаяCVSS 9,8Готовый эксплойтEPSS 77 %

    lexmark · markvision enterprise27 янв. 2020 г.

  • CVE-2019-19824
    43В плане

    On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the b

    ВысокаяCVSS 8,8Proof of conceptEPSS 25 %

    totolink · a3002ru firmware27 янв. 2020 г.

  • CVE-2013-2474
    33Наблюдать

    Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter.

    ВысокаяCVSS 7,5Proof of conceptEPSS 10 %

    aws-dms · aws xms27 янв. 2020 г.

  • CVE-2020-7799
    34Наблюдать

    An issue was discovered in FusionAuth before 1.11.0.

    ВысокаяCVSS 7,2Proof of conceptEPSS 19 %

    fusionauth · fusionauth28 янв. 2020 г.

  • CVE-2013-2571
    44В плане

    Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary commands via a craft

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    hcomm · xpient iris28 янв. 2020 г.

  • CVE-2012-6610
    40В плане

    Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demon

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 10 %

    polycom · hdx video end points28 янв. 2020 г.

  • CVE-2013-4863
    39Наблюдать

    The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code vi

    ВысокаяCVSS 8,8Proof of conceptEPSS 12 %

    micasaverde · veralite firmware28 янв. 2020 г.

  • CVE-2013-1599
    51В плане

    A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/

    КритическаяCVSS 9,8Proof of conceptEPSS 40 %

    dlink · dcs-3411 firmware28 янв. 2020 г.

  • CVE-2013-2748
    43В плане

    Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.

    КритическаяCVSS 9,8Proof of conceptEPSS 13 %

    belkin · wemo switch firmware28 янв. 2020 г.

  • CVE-2013-1600
    27Наблюдать

    An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2

    СредняяCVSS 5,3Proof of conceptEPSS 18 %

    dlink · dcs-2102 firmware28 янв. 2020 г.

  • CVE-2013-1601
    25Наблюдать

    An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video strea

    СредняяCVSS 5,3Proof of conceptEPSS 12 %

    dlink · dcs-3411 firmware28 янв. 2020 г.

  • CVE-2013-3214
    64На этой неделе

    vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.

    КритическаяCVSS 9,8Готовый эксплойтEPSS 84 %

    vtiger · vtiger crm28 янв. 2020 г.

  • CVE-2020-8417
    39Наблюдать

    The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.

    ВысокаяCVSS 8,8Proof of conceptEPSS 11 %

    codesnippets · code snippets28 янв. 2020 г.