По дате публикации
Эксплуатируемые и новые серьёзные CVE: сентябрь 2020 г.
57 записей · 8 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
60На этой неделе | CVE-2019-5645Готовый эксплойт | Rapid7 Metasploit HTTP Handler Denial of Servicerapid7 · metasploit · CWE-400 | Высокая7,5 | — | 41,6 % | 1 сент. 2020 г. |
27Наблюдать | CVE-2020-23839Proof of concept | A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote atget-simple · getsimple cms · CWE-79 | Средняя6,1 | — | 10,4 % | 1 сент. 2020 г. |
62На этой неделе | CVE-2020-24557Готовый эксплойт | A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate amicrosoft · windows | Высокая7,8 | KEV | 2,6 % | 1 сент. 2020 г. |
39Наблюдать | CVE-2020-5776Proof of concept | Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens.magmi project · magmi · CWE-352 | Высокая8,8 | — | 14,7 % | 1 сент. 2020 г. |
46В плане | CVE-2020-5777Proof of concept | MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a magmi project · magmi · CWE-287 | Критическая9,8 | — | 23,3 % | 1 сент. 2020 г. |
89Срочно | CVE-2020-25078Готовый эксплойт | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.dlink · dcs-4603 firmware | Высокая7,5 | KEV | 97,5 % | 2 сент. 2020 г. |
81Срочно | CVE-2020-25079Готовый эксплойт | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.dlink · dcs-4703e firmware · CWE-77 | Высокая8,8 | KEV | 54,0 % | 2 сент. 2020 г. |
43В плане | CVE-2020-14209Proof of concept | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution.dolibarr · dolibarr · CWE-434 | Высокая8,8 | — | 27,4 % | 2 сент. 2020 г. |
55В плане | CVE-2020-24949Proof of concept | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to thephp-fusion · php-fusion | Высокая8,8 | — | 67,5 % | 3 сент. 2020 г. |
32Наблюдать | CVE-2020-24948Эксплойта нет | The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowingautoptimize · autoptimize · CWE-434 | Высокая7,2 | — | 13,1 % | 3 сент. 2020 г. |
40В плане | CVE-2020-25042Готовый эксплойт | An arbitrary file upload issue exists in Mara CMS 7.5.maracms · maracms · CWE-434 | Высокая7,2 | — | 18,5 % | 3 сент. 2020 г. |
38Наблюдать | CVE-2020-11579Proof of concept | An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition.php · php · CWE-306 | Высокая7,5 | — | 26,9 % | 3 сент. 2020 г. |
53В плане | CVE-2020-3495Эксплойта нет | Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerabilitycisco · jabber · CWE-20 | Высокая8,8 | — | 60,5 % | 3 сент. 2020 г. |
40В плане | CVE-2020-14008Proof of concept | Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific locationzohocorp · manageengine applications manager · CWE-434 | Высокая7,2 | — | 39,5 % | 4 сент. 2020 г. |
45В плане | CVE-2020-11117Эксплойта нет | u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulqualcomm · ipq4019 firmware · CWE-77 | Критическая9,8 | — | 19,6 % | 8 сент. 2020 г. |
98Срочно | CVE-2020-25213Готовый эксплойт | The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because filemanagerpro · file manager · CWE-434 | Критическая9,8 | KEV | 97,3 % | 9 сент. 2020 г. |
42В плане | CVE-2020-2036Proof of concept | PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interfacepaloaltonetworks · pan-os · CWE-79 | Высокая8,8 | — | 23,8 % | 9 сент. 2020 г. |
54В плане | CVE-2020-2038Готовый эксплойт | PAN-OS: OS command injection vulnerability in the management web interfacepaloaltonetworks · pan-os · CWE-78 | Высокая7,2 | — | 86,0 % | 9 сент. 2020 г. |
35Наблюдать | CVE-2020-2039Эксплойта нет | PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file uploadpaloaltonetworks · pan-os · CWE-400 | Средняя5,3 | — | 46,3 % | 9 сент. 2020 г. |
44В плане | CVE-2020-24916Эксплойта нет | CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.yaws · yaws · CWE-78 | Критическая9,8 | — | 17,3 % | 9 сент. 2020 г. |
51В плане | CVE-2020-17408Эксплойта нет | This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1.nec · expresscluster x · CWE-611 | Высокая7,5 | — | 69,2 % | 10 сент. 2020 г. |
54В плане | CVE-2020-11998Proof of concept | A regression has been introduced in the commit preventing JMX re-bind.apache · activemq | Критическая9,8 | — | 48,8 % | 10 сент. 2020 г. |
34Наблюдать | CVE-2020-9731Эксплойта нет | Out-of-bounds memory access could lead to code executionadobe · indesign · CWE-788 | Высокая7,8 | — | 11,2 % | 10 сент. 2020 г. |
52В плане | CVE-2020-11991Proof of concept | When using the StreamGenerator, the code parse a user-provided XML.apache · cocoon · CWE-611 | Высокая7,5 | — | 72,4 % | 11 сент. 2020 г. |
60На этой неделе | CVE-2020-0878Готовый эксплойт | Microsoft Browser Memory Corruption Vulnerabilitymicrosoft · internet explorer · CWE-787 | Средняя4,2 | KEV | 2,6 % | 11 сент. 2020 г. |
47В плане | CVE-2020-16875Готовый эксплойт | Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange server · CWE-74 | Высокая8,4 | — | 46,4 % | 11 сент. 2020 г. |
45В плане | CVE-2020-1074Эксплойта нет | Jet Database Engine Remote Code Execution Vulnerabilitymicrosoft · windows 10 | Высокая7,8 | — | 46,0 % | 11 сент. 2020 г. |
53В плане | CVE-2020-25540Proof of concept | ThinkAdmin v6 is affected by a directory traversal vulnerability.thinkadmin · thinkadmin · CWE-22 | Высокая7,5 | — | 75,3 % | 14 сент. 2020 г. |
68На этой неделе | CVE-2019-0230Готовый эксплойт | Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exeapache · struts · CWE-1321 | Критическая9,8 | — | 96,9 % | 14 сент. 2020 г. |
50В плане | CVE-2019-0233Эксплойта нет | An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.apache · struts · CWE-281 | Высокая7,5 | — | 66,1 % | 14 сент. 2020 г. |
63На этой неделе | CVE-2020-15148Proof of concept | Unsafe deserialization in Yii 2yiiframework · yii · CWE-502 | Критическая10,0 | — | 77,5 % | 15 сент. 2020 г. |
58В плане | CVE-2020-6146Эксплойта нет | An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300.gonitro · nitro pro · CWE-122 | Высокая8,8 | — | 75,4 % | 16 сент. 2020 г. |
60На этой неделе | CVE-2020-14181Готовый эксплойт | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vuatlassian · data center · CWE-200 | Средняя5,3 | — | 99,6 % | 16 сент. 2020 г. |
36Наблюдать | CVE-2020-6112Эксплойта нет | An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2gonitro · nitro pro · CWE-823 | Высокая7,8 | — | 17,0 % | 17 сент. 2020 г. |
50В плане | CVE-2020-6113Эксплойта нет | An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updatinggonitro · nitro pro · CWE-190 | Высокая7,8 | — | 64,1 % | 17 сент. 2020 г. |
40В плане | CVE-2020-6116Эксплойта нет | An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242.gonitro · nitro pro · CWE-680 | Высокая7,8 | — | 28,4 % | 17 сент. 2020 г. |
32Наблюдать | CVE-2020-13944Эксплойта нет | In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.apache · airflow · CWE-79 | Средняя6,1 | — | 25,0 % | 17 сент. 2020 г. |
61На этой неделе | CVE-2020-11698Готовый эксплойт | An issue was discovered in Titan SpamTitan 7.07.titanhq · spamtitan · CWE-77 | Критическая9,8 | — | 73,1 % | 17 сент. 2020 г. |
29Наблюдать | CVE-2020-5421Proof of concept | RFD Protection Bypass via jsessionidvmware · spring framework · CWE-020 | Средняя6,5 | — | 11,5 % | 19 сент. 2020 г. |
45В плане | CVE-2020-25787Proof of concept | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.tt-rss · tiny tiny rss · CWE-20 | Критическая9,8 | — | 18,4 % | 19 сент. 2020 г. |
33Наблюдать | CVE-2020-25790Proof of concept | Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive.typesettercms · typesetter · CWE-434 | Высокая7,2 | — | 15,5 % | 19 сент. 2020 г. |
44В плане | CVE-2020-14179Proof of concept | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLAatlassian · jira data center | Средняя5,3 | — | 76,0 % | 20 сент. 2020 г. |
41В плане | CVE-2020-6541Эксплойта нет | Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafgoogle · chrome · CWE-416 | Высокая8,8 | — | 21,6 % | 21 сент. 2020 г. |
43В плане | CVE-2020-6549Эксплойта нет | Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftgoogle · chrome · CWE-416 | Высокая8,8 | — | 27,5 % | 21 сент. 2020 г. |
43В плане | CVE-2020-6550Эксплойта нет | Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a cgoogle · chrome · CWE-416 | Высокая8,8 | — | 27,5 % | 21 сент. 2020 г. |
43В плане | CVE-2020-6551Эксплойта нет | Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftgoogle · chrome · CWE-416 | Высокая8,8 | — | 27,7 % | 21 сент. 2020 г. |
40В плане | CVE-2020-11855Готовый эксплойт | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.microfocus · operation bridge reporter · CWE-732 | Высокая7,8 | — | 1,3 % | 22 сент. 2020 г. |
60На этой неделе | CVE-2020-11857Готовый эксплойт | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.microfocus · operation bridge reporter · CWE-798 | Критическая9,8 | — | 15,7 % | 22 сент. 2020 г. |
24Наблюдать | CVE-2019-15993Proof of concept | Cisco Small Business Switches Information Disclosure Vulnerabilitycisco · sg250x-24 firmware · CWE-16 | Средняя5,3 | — | 10,2 % | 22 сент. 2020 г. |
65На этой неделе | CVE-2020-3569Готовый эксплойт | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilitiescisco · ios xr · CWE-400 | Высокая8,6 | KEV | 3,3 % | 22 сент. 2020 г. |
38Наблюдать | CVE-2020-24365Proof of concept | An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices.gemteks · wrtm-127acn firmware · CWE-78 | Высокая8,8 | — | 11,4 % | 24 сент. 2020 г. |
42В плане | CVE-2020-15160Proof of concept | Blind SQL Injection in PrestaShopprestashop · prestashop · CWE-89 | Критическая9,8 | — | 10,8 % | 24 сент. 2020 г. |
98Срочно | CVE-2020-25223Готовый эксплойт | A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11sophos · unified threat management · CWE-78 | Критическая9,8 | KEV | 96,7 % | 25 сент. 2020 г. |
42В плане | CVE-2018-5353Proof of concept | The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalatezohocorp · manageengine adselfservice plus · CWE-290 | Критическая9,8 | — | 11,1 % | 30 сент. 2020 г. |
51В плане | CVE-2020-13951Proof of concept | Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.apache · openmeetings | Высокая7,5 | — | 68,5 % | 30 сент. 2020 г. |
39Наблюдать | CVE-2020-25762Proof of concept | An issue was discovered in SourceCodester Seat Reservation System 1.0.seat reservation system project · seat reservation system · CWE-89 | Критическая9,1 | — | 11,3 % | 30 сент. 2020 г. |
85Срочно | CVE-2020-8243Готовый эксплойт | A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template toivanti · connect secure · CWE-94 | Высокая7,2 | KEV | 90,7 % | 30 сент. 2020 г. |
- CVE-2019-564560На этой неделе
Rapid7 Metasploit HTTP Handler Denial of Service
ВысокаяCVSS 7,5Готовый эксплойтEPSS 41 %rapid7 · metasploit1 сент. 2020 г.
- CVE-2020-2383927Наблюдать
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote at
СредняяCVSS 6,1Proof of conceptEPSS 10 %get-simple · getsimple cms1 сент. 2020 г.
- CVE-2020-2455762На этой неделе
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 2 %microsoft · windows1 сент. 2020 г.
- CVE-2020-577639Наблюдать
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens.
ВысокаяCVSS 8,8Proof of conceptEPSS 14 %magmi project · magmi1 сент. 2020 г.
- CVE-2020-577746В плане
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a
КритическаяCVSS 9,8Proof of conceptEPSS 23 %magmi project · magmi1 сент. 2020 г.
- CVE-2020-2507889Срочно
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 97 %dlink · dcs-4603 firmware2 сент. 2020 г.
- CVE-2020-2507981Срочно
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 54 %dlink · dcs-4703e firmware2 сент. 2020 г.
- CVE-2020-1420943В плане
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution.
ВысокаяCVSS 8,8Proof of conceptEPSS 27 %dolibarr · dolibarr2 сент. 2020 г.
- CVE-2020-2494955В плане
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the
ВысокаяCVSS 8,8Proof of conceptEPSS 67 %php-fusion · php-fusion3 сент. 2020 г.
- CVE-2020-2494832Наблюдать
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing
ВысокаяCVSS 7,2Эксплойта нетEPSS 13 %autoptimize · autoptimize3 сент. 2020 г.
- CVE-2020-2504240В плане
An arbitrary file upload issue exists in Mara CMS 7.5.
ВысокаяCVSS 7,2Готовый эксплойтEPSS 18 %maracms · maracms3 сент. 2020 г.
- CVE-2020-1157938Наблюдать
An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition.
ВысокаяCVSS 7,5Proof of conceptEPSS 26 %php · php3 сент. 2020 г.
- CVE-2020-349553В плане
Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 60 %cisco · jabber3 сент. 2020 г.
- CVE-2020-1400840В плане
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location
ВысокаяCVSS 7,2Proof of conceptEPSS 39 %zohocorp · manageengine applications manager4 сент. 2020 г.
- CVE-2020-1111745В плане
u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resul
КритическаяCVSS 9,8Эксплойта нетEPSS 19 %qualcomm · ipq4019 firmware8 сент. 2020 г.
- CVE-2020-2521398Срочно
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 97 %filemanagerpro · file manager9 сент. 2020 г.
- CVE-2020-203642В плане
PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface
ВысокаяCVSS 8,8Proof of conceptEPSS 23 %paloaltonetworks · pan-os9 сент. 2020 г.
- CVE-2020-203854В плане
PAN-OS: OS command injection vulnerability in the management web interface
ВысокаяCVSS 7,2Готовый эксплойтEPSS 86 %paloaltonetworks · pan-os9 сент. 2020 г.
- CVE-2020-203935Наблюдать
PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload
СредняяCVSS 5,3Эксплойта нетEPSS 46 %paloaltonetworks · pan-os9 сент. 2020 г.
- CVE-2020-2491644В плане
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
КритическаяCVSS 9,8Эксплойта нетEPSS 17 %yaws · yaws9 сент. 2020 г.
- CVE-2020-1740851В плане
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1.
ВысокаяCVSS 7,5Эксплойта нетEPSS 69 %nec · expresscluster x10 сент. 2020 г.
- CVE-2020-1199854В плане
A regression has been introduced in the commit preventing JMX re-bind.
КритическаяCVSS 9,8Proof of conceptEPSS 48 %apache · activemq10 сент. 2020 г.
- CVE-2020-973134Наблюдать
Out-of-bounds memory access could lead to code execution
ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %adobe · indesign10 сент. 2020 г.
- CVE-2020-1199152В плане
When using the StreamGenerator, the code parse a user-provided XML.
ВысокаяCVSS 7,5Proof of conceptEPSS 72 %apache · cocoon11 сент. 2020 г.
- CVE-2020-087860На этой неделе
Microsoft Browser Memory Corruption Vulnerability
СредняяCVSS 4,2KEVГотовый эксплойтEPSS 2 %microsoft · internet explorer11 сент. 2020 г.
- CVE-2020-1687547В плане
Microsoft Exchange Server Remote Code Execution Vulnerability
ВысокаяCVSS 8,4Готовый эксплойтEPSS 46 %microsoft · exchange server11 сент. 2020 г.
- CVE-2020-107445В плане
Jet Database Engine Remote Code Execution Vulnerability
ВысокаяCVSS 7,8Эксплойта нетEPSS 46 %microsoft · windows 1011 сент. 2020 г.
- CVE-2020-2554053В плане
ThinkAdmin v6 is affected by a directory traversal vulnerability.
ВысокаяCVSS 7,5Proof of conceptEPSS 75 %thinkadmin · thinkadmin14 сент. 2020 г.
- CVE-2019-023068На этой неделе
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exe
КритическаяCVSS 9,8Готовый эксплойтEPSS 96 %apache · struts14 сент. 2020 г.
- CVE-2019-023350В плане
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
ВысокаяCVSS 7,5Эксплойта нетEPSS 66 %apache · struts14 сент. 2020 г.
- CVE-2020-1514863На этой неделе
Unsafe deserialization in Yii 2
КритическаяCVSS 10,0Proof of conceptEPSS 77 %yiiframework · yii15 сент. 2020 г.
- CVE-2020-614658В плане
An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300.
ВысокаяCVSS 8,8Эксплойта нетEPSS 75 %gonitro · nitro pro16 сент. 2020 г.
- CVE-2020-1418160На этой неделе
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu
СредняяCVSS 5,3Готовый эксплойтEPSS 99 %atlassian · data center16 сент. 2020 г.
- CVE-2020-611236Наблюдать
An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %gonitro · nitro pro17 сент. 2020 г.
- CVE-2020-611350В плане
An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating
ВысокаяCVSS 7,8Эксплойта нетEPSS 64 %gonitro · nitro pro17 сент. 2020 г.
- CVE-2020-611640В плане
An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242.
ВысокаяCVSS 7,8Эксплойта нетEPSS 28 %gonitro · nitro pro17 сент. 2020 г.
- CVE-2020-1394432Наблюдать
In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.
СредняяCVSS 6,1Эксплойта нетEPSS 25 %apache · airflow17 сент. 2020 г.
- CVE-2020-1169861На этой неделе
An issue was discovered in Titan SpamTitan 7.07.
КритическаяCVSS 9,8Готовый эксплойтEPSS 73 %titanhq · spamtitan17 сент. 2020 г.
- CVE-2020-542129Наблюдать
RFD Protection Bypass via jsessionid
СредняяCVSS 6,5Proof of conceptEPSS 11 %vmware · spring framework19 сент. 2020 г.
- CVE-2020-2578745В плане
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.
КритическаяCVSS 9,8Proof of conceptEPSS 18 %tt-rss · tiny tiny rss19 сент. 2020 г.
- CVE-2020-2579033Наблюдать
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive.
ВысокаяCVSS 7,2Proof of conceptEPSS 15 %typesettercms · typesetter19 сент. 2020 г.
- CVE-2020-1417944В плане
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA
СредняяCVSS 5,3Proof of conceptEPSS 76 %atlassian · jira data center20 сент. 2020 г.
- CVE-2020-654141В плане
Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a craf
ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %google · chrome21 сент. 2020 г.
- CVE-2020-654943В плане
Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft
ВысокаяCVSS 8,8Эксплойта нетEPSS 27 %google · chrome21 сент. 2020 г.
- CVE-2020-655043В плане
Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a c
ВысокаяCVSS 8,8Эксплойта нетEPSS 27 %google · chrome21 сент. 2020 г.
- CVE-2020-655143В плане
Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft
ВысокаяCVSS 8,8Эксплойта нетEPSS 27 %google · chrome21 сент. 2020 г.
- CVE-2020-1185540В плане
An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.
ВысокаяCVSS 7,8Готовый эксплойтEPSS 1 %microfocus · operation bridge reporter22 сент. 2020 г.
- CVE-2020-1185760На этой неделе
An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.
КритическаяCVSS 9,8Готовый эксплойтEPSS 15 %microfocus · operation bridge reporter22 сент. 2020 г.
- CVE-2019-1599324Наблюдать
Cisco Small Business Switches Information Disclosure Vulnerability
СредняяCVSS 5,3Proof of conceptEPSS 10 %cisco · sg250x-24 firmware22 сент. 2020 г.
- CVE-2020-356965На этой неделе
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
ВысокаяCVSS 8,6KEVГотовый эксплойтEPSS 3 %cisco · ios xr22 сент. 2020 г.
- CVE-2020-2436538Наблюдать
An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices.
ВысокаяCVSS 8,8Proof of conceptEPSS 11 %gemteks · wrtm-127acn firmware24 сент. 2020 г.
- CVE-2020-1516042В плане
Blind SQL Injection in PrestaShop
КритическаяCVSS 9,8Proof of conceptEPSS 10 %prestashop · prestashop24 сент. 2020 г.
- CVE-2020-2522398Срочно
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 96 %sophos · unified threat management25 сент. 2020 г.
- CVE-2018-535342В плане
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate
КритическаяCVSS 9,8Proof of conceptEPSS 11 %zohocorp · manageengine adselfservice plus30 сент. 2020 г.
- CVE-2020-1395151В плане
Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
ВысокаяCVSS 7,5Proof of conceptEPSS 68 %apache · openmeetings30 сент. 2020 г.
- CVE-2020-2576239Наблюдать
An issue was discovered in SourceCodester Seat Reservation System 1.0.
КритическаяCVSS 9,1Proof of conceptEPSS 11 %seat reservation system project · seat reservation system30 сент. 2020 г.
- CVE-2020-824385Срочно
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 90 %ivanti · connect secure30 сент. 2020 г.