По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2020 г.
119 записей · 7 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
35Наблюдать | CVE-2013-1602Proof of concept | An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5dlink · dcs-3411 firmware · CWE-200 | Высокая7,5 | — | 15,0 % | 28 янв. 2020 г. |
26Наблюдать | CVE-2013-1603Proof of concept | An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-741dlink · dcs-3411 firmware · CWE-798 | Средняя5,3 | — | 16,1 % | 28 янв. 2020 г. |
62На этой неделе | CVE-2019-20215Готовый эксплойт | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in dlink · dir-859 firmware · CWE-78 | Критическая9,8 | — | 75,1 % | 28 янв. 2020 г. |
99Срочно | CVE-2020-7247Готовый эксплойт | smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary coopenbsd · opensmtpd · CWE-78 | Критическая9,8 | KEV | 98,9 % | 29 янв. 2020 г. |
34Наблюдать | CVE-2013-2567Proof of concept | An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account foundzavio · f3105 firmware · CWE-798 | Высокая7,5 | — | 14,5 % | 29 янв. 2020 г. |
34Наблюдать | CVE-2020-8416Proof of concept | IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.iktm · bearftp · CWE-770 | Высокая7,5 | — | 14,2 % | 29 янв. 2020 г. |
54В плане | CVE-2013-2568Proof of concept | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which coulzavio · f3105 firmware · CWE-78 | Критическая9,8 | — | 48,5 % | 29 янв. 2020 г. |
39Наблюдать | CVE-2013-2569Proof of concept | A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, whzavio · f3105 firmware · CWE-287 | Высокая7,5 | — | 30,9 % | 29 янв. 2020 г. |
47В плане | CVE-2013-2570Proof of concept | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 functionzavio · f3105 firmware · CWE-78 | Критическая9,8 | — | 26,5 % | 29 янв. 2020 г. |
60На этой неделе | CVE-2013-3215Готовый эксплойт | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSessionvtiger · vtiger crm · CWE-287 | Критическая9,8 | — | 68,8 % | 29 янв. 2020 г. |
37Наблюдать | CVE-2019-18634Proof of concept | In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo procsudo project · sudo · CWE-787 | Высокая7,8 | — | 19,2 % | 29 янв. 2020 г. |
35Наблюдать | CVE-2013-2572Proof of concept | A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-ctp-link · tl-sc 3130 firmware · CWE-798 | Высокая7,5 | — | 16,4 % | 29 янв. 2020 г. |
52В плане | CVE-2013-2573Proof of concept | A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-tp-link · tl-sc 3130g firmware · CWE-78 | Критическая9,8 | — | 42,2 % | 29 янв. 2020 г. |
39Наблюдать | CVE-2013-2574Proof of concept | An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, whicfoscam · fi8620 firmware · CWE-863 | Высокая7,5 | — | 29,5 % | 29 янв. 2020 г. |
43В плане | CVE-2020-3716Эксплойта нет | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted damagento · magento · CWE-502 | Критическая9,8 | — | 13,9 % | 29 янв. 2020 г. |
40В плане | CVE-2019-20445Эксплойта нет | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Trnetty · netty · CWE-444 | Критическая9,1 | — | 13,8 % | 29 янв. 2020 г. |
35Наблюдать | CVE-2013-0291Proof of concept | NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerabilityimagely · nextgen gallery · CWE-200 | Высокая7,5 | — | 15,6 % | 30 янв. 2020 г. |
46В плане | CVE-2014-8322Proof of concept | Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbiaircrack-ng · aircrack-ng · CWE-787 | Критическая9,8 | — | 23,9 % | 31 янв. 2020 г. |
28Наблюдать | CVE-2020-8512Proof of concept | In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.icewarp · icewarp server · CWE-79 | Средняя6,1 | — | 14,8 % | 31 янв. 2020 г. |
- CVE-2013-160235Наблюдать
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5
ВысокаяCVSS 7,5Proof of conceptEPSS 15 %dlink · dcs-3411 firmware28 янв. 2020 г.
- CVE-2013-160326Наблюдать
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-741
СредняяCVSS 5,3Proof of conceptEPSS 16 %dlink · dcs-3411 firmware28 янв. 2020 г.
- CVE-2019-2021562На этой неделе
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in
КритическаяCVSS 9,8Готовый эксплойтEPSS 75 %dlink · dir-859 firmware28 янв. 2020 г.
- CVE-2020-724799Срочно
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary co
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 98 %openbsd · opensmtpd29 янв. 2020 г.
- CVE-2013-256734Наблюдать
An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found
ВысокаяCVSS 7,5Proof of conceptEPSS 14 %zavio · f3105 firmware29 янв. 2020 г.
- CVE-2020-841634Наблюдать
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.
ВысокаяCVSS 7,5Proof of conceptEPSS 14 %iktm · bearftp29 янв. 2020 г.
- CVE-2013-256854В плане
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which coul
КритическаяCVSS 9,8Proof of conceptEPSS 48 %zavio · f3105 firmware29 янв. 2020 г.
- CVE-2013-256939Наблюдать
A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, wh
ВысокаяCVSS 7,5Proof of conceptEPSS 30 %zavio · f3105 firmware29 янв. 2020 г.
- CVE-2013-257047В плане
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function
КритическаяCVSS 9,8Proof of conceptEPSS 26 %zavio · f3105 firmware29 янв. 2020 г.
- CVE-2013-321560На этой неделе
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession
КритическаяCVSS 9,8Готовый эксплойтEPSS 68 %vtiger · vtiger crm29 янв. 2020 г.
- CVE-2019-1863437Наблюдать
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo proc
ВысокаяCVSS 7,8Proof of conceptEPSS 19 %sudo project · sudo29 янв. 2020 г.
- CVE-2013-257235Наблюдать
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-c
ВысокаяCVSS 7,5Proof of conceptEPSS 16 %tp-link · tl-sc 3130 firmware29 янв. 2020 г.
- CVE-2013-257352В плане
A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-
КритическаяCVSS 9,8Proof of conceptEPSS 42 %tp-link · tl-sc 3130g firmware29 янв. 2020 г.
- CVE-2013-257439Наблюдать
An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, whic
ВысокаяCVSS 7,5Proof of conceptEPSS 29 %foscam · fi8620 firmware29 янв. 2020 г.
- CVE-2020-371643В плане
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted da
КритическаяCVSS 9,8Эксплойта нетEPSS 13 %magento · magento29 янв. 2020 г.
- CVE-2019-2044540В плане
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr
КритическаяCVSS 9,1Эксплойта нетEPSS 13 %netty · netty29 янв. 2020 г.
- CVE-2013-029135Наблюдать
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 15 %imagely · nextgen gallery30 янв. 2020 г.
- CVE-2014-832246В плане
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbi
КритическаяCVSS 9,8Proof of conceptEPSS 23 %aircrack-ng · aircrack-ng31 янв. 2020 г.
- CVE-2020-851228Наблюдать
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
СредняяCVSS 6,1Proof of conceptEPSS 14 %icewarp · icewarp server31 янв. 2020 г.