По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2021 г.
76 записей · 10 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
42В плане | CVE-2020-35948Proof of concept | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress.xcloner · xcloner · CWE-863 | Высокая8,8 | — | 24,9 % | 1 янв. 2021 г. |
62На этой неделе | CVE-2020-35951Proof of concept | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.expresstech · quiz and survey master · CWE-306 | Критическая9,9 | — | 76,3 % | 1 янв. 2021 г. |
37Наблюдать | CVE-2020-35391Proof of concept | Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a diretenda · f3 firmware · CWE-425 | Средняя6,5 | — | 35,2 % | 1 янв. 2021 г. |
62На этой неделе | CVE-2021-3007Proof of concept | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execuzend · zend framework · CWE-502 | Критическая9,8 | — | 75,3 % | 3 янв. 2021 г. |
44В плане | CVE-2020-36112Proof of concept | CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookcse bookstore project · cse bookstore · CWE-89 | Критическая9,8 | — | 18,0 % | 4 янв. 2021 г. |
45В плане | CVE-2021-3018Proof of concept | ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the ipeak · ipeakcms · CWE-89 | Критическая9,8 | — | 18,5 % | 5 янв. 2021 г. |
35Наблюдать | CVE-2021-3019Proof of concept | ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.lanproxy project · lanproxy · CWE-22 | Высокая7,5 | — | 16,6 % | 5 янв. 2021 г. |
45В плане | CVE-2020-17518Proof of concept | Apache Flink directory traversal attack: remote file writing through the REST APIapache · flink · CWE-23 | Высокая7,5 | — | 49,1 % | 5 янв. 2021 г. |
89Срочно | CVE-2020-17519Готовый эксплойт | Apache Flink directory traversal attack: reading remote files through the REST APIapache · flink · CWE-552 | Высокая7,5 | KEV | 97,8 % | 5 янв. 2021 г. |
36Наблюдать | CVE-2021-21234Proof of concept | spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint.spring-boot-actuator-logview project · spring-boot-actuator-logview · CWE-22 | Высокая7,7 | — | 21,0 % | 5 янв. 2021 г. |
44В плане | CVE-2020-8264Эксплойта нет | In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to srubyonrails · rails · CWE-79 | Средняя6,1 | — | 66,9 % | 6 янв. 2021 г. |
31Наблюдать | CVE-2020-8287Proof of concept | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Enodejs · node.js · CWE-444 | Средняя6,5 | — | 16,2 % | 6 янв. 2021 г. |
37Наблюдать | CVE-2020-36179Proof of concept | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apacfasterxml · jackson-databind · CWE-502 | Высокая8,1 | — | 17,0 % | 6 янв. 2021 г. |
32Наблюдать | CVE-2020-28672Эксплойта нет | MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution.monocms · monocms | Высокая7,2 | — | 12,1 % | 7 янв. 2021 г. |
25Наблюдать | CVE-2021-23241Proof of concept | MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bmercusys · mercury x18g firmware · CWE-22 | Средняя5,3 | — | 13,3 % | 7 янв. 2021 г. |
36Наблюдать | CVE-2020-24577Эксплойта нет | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.dlink · dsl-2888a firmware · CWE-312 | Высокая7,5 | — | 19,0 % | 8 янв. 2021 г. |
54В плане | CVE-2020-35131Proof of concept | Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/Magentejo · cockpit · CWE-94 | Критическая9,8 | — | 50,2 % | 8 янв. 2021 г. |
24Наблюдать | CVE-2020-28208Proof of concept | An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.rocket.chat · rocket.chat · CWE-203 | Средняя5,3 | — | 10,8 % | 8 янв. 2021 г. |
66На этой неделе | CVE-2020-16013Готовый эксплойт | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption google · chrome · CWE-787 | Высокая8,8 | KEV | 2,7 % | 8 янв. 2021 г. |
69На этой неделе | CVE-2020-16017Готовый эксплойт | Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process google · chrome · CWE-416 | Критическая9,6 | KEV | 2,7 % | 8 янв. 2021 г. |
60На этой неделе | CVE-2020-16040Готовый эксплойт | Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption vgoogle · chrome · CWE-20 | Средняя6,5 | — | 99,5 % | 8 янв. 2021 г. |
99Срочно | CVE-2021-3129Готовый эксплойт | Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of ilaravel · laravel | Критическая9,8 | KEV | 99,9 % | 12 янв. 2021 г. |
73На этой неделе | CVE-2021-1647Готовый эксплойт | Microsoft Defender Remote Code Execution Vulnerabilitymicrosoft · windows defender | Высокая7,8 | KEV | 39,6 % | 12 янв. 2021 г. |
38Наблюдать | CVE-2021-1678Proof of concept | Windows Print Spooler Spoofing Vulnerabilitymicrosoft · windows 10 | Высокая8,8 | — | 10,0 % | 12 янв. 2021 г. |
48В плане | CVE-2021-23124Эксплойта нет | [20210102] - Core - XSS in mod_breadcrumbs aria-label attributejoomla · joomla\! · CWE-79 | Средняя6,1 | — | 78,9 % | 12 янв. 2021 г. |
53В плане | CVE-2020-35578Готовый эксплойт | An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.nagios · nagios xi · CWE-78 | Высокая7,2 | — | 81,9 % | 13 янв. 2021 г. |
42В плане | CVE-2020-27265Эксплойта нет | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All verge · industrial gateway server · CWE-121 | Критическая9,8 | — | 10,4 % | 13 янв. 2021 г. |
30Наблюдать | CVE-2021-24122Эксплойта нет | Apache Tomcat information disclosureapache · tomcat · CWE-200 | Средняя5,9 | — | 22,8 % | 14 янв. 2021 г. |
68На этой неделе | CVE-2020-6572Готовый эксплойт | Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.google · chrome · CWE-416 | Высокая8,8 | KEV | 10,5 % | 14 янв. 2021 г. |
39Наблюдать | CVE-2020-35749Proof of concept | Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier forpresstigers · simple board job · CWE-22 | Высокая7,7 | — | 30,4 % | 15 янв. 2021 г. |
55В плане | CVE-2021-21243Эксплойта нет | Pre-Auth Unsafe Deserialization on KubernetesResourceonedev project · onedev · CWE-74 | Критическая9,8 | — | 54,4 % | 15 янв. 2021 г. |
61На этой неделе | CVE-2021-21242Эксплойта нет | Pre-Auth Unsafe Deserialization on AttachmentUploadServetonedev project · onedev · CWE-74 | Критическая9,8 | — | 74,1 % | 15 янв. 2021 г. |
45В плане | CVE-2021-21246Proof of concept | Pre-Auth Access token leakonedev project · onedev · CWE-862 | Высокая7,5 | — | 49,0 % | 15 янв. 2021 г. |
39Наблюдать | CVE-2021-21251Эксплойта нет | ZipSlip Arbitrary File Uploadonedev project · onedev · CWE-22 | Высокая8,8 | — | 12,6 % | 15 янв. 2021 г. |
42В плане | CVE-2021-25294Эксплойта нет | OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution.opencats · opencats · CWE-502 | Критическая9,8 | — | 11,3 % | 18 янв. 2021 г. |
81Срочно | CVE-2020-36193Готовый эксплойт | Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a relatphp · archive tar · CWE-22 | Высокая7,5 | KEV | 70,5 % | 18 янв. 2021 г. |
46В плане | CVE-2021-3177Эксплойта нет | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Pythpython · python · CWE-120 | Критическая9,8 | — | 24,2 % | 19 янв. 2021 г. |
39Наблюдать | CVE-2020-23342Proof of concept | A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.anchorcms · anchor cms · CWE-352 | Высокая8,8 | — | 12,4 % | 19 янв. 2021 г. |
35Наблюдать | CVE-2020-19360Proof of concept | Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead tofhem · fhem · CWE-22 | Высокая7,5 | — | 17,2 % | 19 янв. 2021 г. |
56В плане | CVE-2020-19364Эксплойта нет | OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.open-emr · openemr · CWE-434 | Высокая8,8 | — | 70,5 % | 19 янв. 2021 г. |
29Наблюдать | CVE-2020-25385Эксплойта нет | Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshnagios · log server · CWE-79 | Средняя6,1 | — | 16,3 % | 19 янв. 2021 г. |
45В плане | CVE-2021-3110Proof of concept | The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_proprestashop · prestashop · CWE-89 | Критическая9,8 | — | 18,6 % | 20 янв. 2021 г. |
61На этой неделе | CVE-2020-14756Proof of concept | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components).oracle · coherence | Критическая9,8 | — | 74,7 % | 20 янв. 2021 г. |
22Наблюдать | CVE-2021-2021Эксплойта нет | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).oracle · mysql | Средняя4,9 | — | 10,0 % | 20 янв. 2021 г. |
49В плане | CVE-2021-2109Proof of concept | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).oracle · weblogic server | Высокая7,2 | — | 70,4 % | 20 янв. 2021 г. |
50В плане | CVE-2021-2114Эксплойта нет | Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar).oracle · common applications calendar | Высокая8,2 | — | 59,3 % | 20 янв. 2021 г. |
49В плане | CVE-2020-25683Эксплойта нет | A flaw was found in dnsmasq before version 2.83.thekelleys · dnsmasq · CWE-122 | Средняя5,9 | — | 86,0 % | 20 янв. 2021 г. |
56В плане | CVE-2020-25681Эксплойта нет | A flaw was found in dnsmasq before version 2.83.thekelleys · dnsmasq · CWE-122 | Высокая8,1 | — | 81,1 % | 20 янв. 2021 г. |
53В плане | CVE-2020-25682Эксплойта нет | A flaw was found in dnsmasq before 2.83.thekelleys · dnsmasq · CWE-122 | Высокая8,1 | — | 70,7 % | 20 янв. 2021 г. |
49В плане | CVE-2020-25687Эксплойта нет | A flaw was found in dnsmasq before version 2.83.thekelleys · dnsmasq · CWE-122 | Средняя5,9 | — | 86,6 % | 20 янв. 2021 г. |
52В плане | CVE-2020-27858Эксплойта нет | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5.arcserve · d2d · CWE-611 | Высокая7,5 | — | 73,8 % | 20 янв. 2021 г. |
44В плане | CVE-2020-12513Эксплойта нет | Pepper+Fuchs Comtrol IO-Link Master OS Command Injectionpepperl-fuchs · io-link master 4-eip firmware · CWE-78 | Высокая8,8 | — | 31,1 % | 22 янв. 2021 г. |
39Наблюдать | CVE-2020-23826Эксплойта нет | The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API.assaabloy · yale wipc-303w firmware · CWE-78 | Высокая8,8 | — | 13,1 % | 26 янв. 2021 г. |
48В плане | CVE-2020-35576Proof of concept | A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticatetp-link · tl-wr841n firmware · CWE-78 | Высокая8,8 | — | 42,2 % | 26 янв. 2021 г. |
45В плане | CVE-2021-22873Proof of concept | Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delirevive-adserver · revive adserver · CWE-601 | Средняя6,1 | — | 69,5 % | 26 янв. 2021 г. |
36Наблюдать | CVE-2021-3223Proof of concept | Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.nodered · node-red-dashboard · CWE-22 | Высокая7,5 | — | 18,8 % | 26 янв. 2021 г. |
47В плане | CVE-2021-3278Proof of concept | Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection .local services search engine management system project · local services search engine management system · CWE-89 | Критическая9,8 | — | 25,2 % | 26 янв. 2021 г. |
33Наблюдать | CVE-2021-3291Proof of concept | Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and zen-cart · zen cart · CWE-78 | Высокая7,2 | — | 16,7 % | 26 янв. 2021 г. |
37Наблюдать | CVE-2021-3297Proof of concept | On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.zyxel · nbg2105 firmware · CWE-287 | Высокая7,8 | — | 20,5 % | 26 янв. 2021 г. |
91Срочно | CVE-2021-3156Готовый эксплойт | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root sudo project · sudo · CWE-193 | Высокая7,8 | KEV | 99,9 % | 26 янв. 2021 г. |
55В плане | CVE-2020-36221Эксплойта нет | An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resultopenldap · openldap · CWE-191 | Высокая7,5 | — | 84,9 % | 26 янв. 2021 г. |
53В плане | CVE-2020-36222Эксплойта нет | A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial openldap · openldap · CWE-617 | Высокая7,5 | — | 77,2 % | 26 янв. 2021 г. |
53В плане | CVE-2020-36227Эксплойта нет | A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in deopenldap · openldap · CWE-835 | Высокая7,5 | — | 77,2 % | 26 янв. 2021 г. |
55В плане | CVE-2020-36228Эксплойта нет | An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, ropenldap · openldap · CWE-191 | Высокая7,5 | — | 84,9 % | 26 янв. 2021 г. |
34Наблюдать | CVE-2020-36230Эксплойта нет | A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_elemenopenldap · openldap · CWE-617 | Высокая7,5 | — | 12,1 % | 26 янв. 2021 г. |
75На этой неделе | CVE-2021-3199Готовый эксплойт | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..onlyoffice · document server · CWE-22 | Критическая9,8 | KEV | 20,1 % | 26 янв. 2021 г. |
47В плане | CVE-2021-3317Proof of concept | KLog Server through 2.4.1 allows authenticated command injection.klogserver · klog server · CWE-78 | Высокая8,8 | — | 41,3 % | 26 янв. 2021 г. |
33Наблюдать | CVE-2021-26117Эксплойта нет | ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bindapache · activemq · CWE-287 | Высокая7,5 | — | 11,3 % | 27 янв. 2021 г. |
54В плане | CVE-2020-4888Эксплойта нет | IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system,ibm · qradar security information and event manager · CWE-502 | Высокая8,8 | — | 61,9 % | 28 янв. 2021 г. |
29Наблюдать | CVE-2021-22874Эксплойта нет | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.revive-adserver · revive adserver · CWE-79 | Средняя6,1 | — | 18,2 % | 28 янв. 2021 г. |
29Наблюдать | CVE-2021-22875Эксплойта нет | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.revive-adserver · revive adserver · CWE-79 | Средняя6,1 | — | 18,2 % | 28 янв. 2021 г. |
31Наблюдать | CVE-2020-35754Proof of concept | OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Executopensolution · quick.cart · CWE-94 | Высокая7,2 | — | 10,4 % | 28 янв. 2021 г. |
33Наблюдать | CVE-2021-3337Proof of concept | The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clickihide thread content project · hide thread content · CWE-863 | Высокая7,5 | — | 11,4 % | 28 янв. 2021 г. |
85Срочно | CVE-2020-29557Готовый эксплойт | An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20.dlink · dir-825 r1 firmware · CWE-119 | Критическая9,8 | KEV | 54,3 % | 29 янв. 2021 г. |
65На этой неделе | CVE-2021-25646Готовый эксплойт | Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.apache · druid | Высокая8,8 | — | 99,0 % | 29 янв. 2021 г. |
48В плане | CVE-2020-15568Proof of concept | TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root.terra-master · tos · CWE-913 | Критическая9,8 | — | 28,9 % | 30 янв. 2021 г. |
- CVE-2020-3594842В плане
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress.
ВысокаяCVSS 8,8Proof of conceptEPSS 24 %xcloner · xcloner1 янв. 2021 г.
- CVE-2020-3595162На этой неделе
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.
КритическаяCVSS 9,9Proof of conceptEPSS 76 %expresstech · quiz and survey master1 янв. 2021 г.
- CVE-2020-3539137Наблюдать
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a dire
СредняяCVSS 6,5Proof of conceptEPSS 35 %tenda · f3 firmware1 янв. 2021 г.
- CVE-2021-300762На этой неделе
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execu
КритическаяCVSS 9,8Proof of conceptEPSS 75 %zend · zend framework3 янв. 2021 г.
- CVE-2020-3611244В плане
CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in book
КритическаяCVSS 9,8Proof of conceptEPSS 18 %cse bookstore project · cse bookstore4 янв. 2021 г.
- CVE-2021-301845В плане
ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the
КритическаяCVSS 9,8Proof of conceptEPSS 18 %ipeak · ipeakcms5 янв. 2021 г.
- CVE-2021-301935Наблюдать
ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.
ВысокаяCVSS 7,5Proof of conceptEPSS 16 %lanproxy project · lanproxy5 янв. 2021 г.
- CVE-2020-1751845В плане
Apache Flink directory traversal attack: remote file writing through the REST API
ВысокаяCVSS 7,5Proof of conceptEPSS 49 %apache · flink5 янв. 2021 г.
- CVE-2020-1751989Срочно
Apache Flink directory traversal attack: reading remote files through the REST API
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 97 %apache · flink5 янв. 2021 г.
- CVE-2021-2123436Наблюдать
spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint.
ВысокаяCVSS 7,7Proof of conceptEPSS 21 %spring-boot-actuator-logview project · spring-boot-actuator-logview5 янв. 2021 г.
- CVE-2020-826444В плане
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to s
СредняяCVSS 6,1Эксплойта нетEPSS 66 %rubyonrails · rails6 янв. 2021 г.
- CVE-2020-828731Наблюдать
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-E
СредняяCVSS 6,5Proof of conceptEPSS 16 %nodejs · node.js6 янв. 2021 г.
- CVE-2020-3617937Наблюдать
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac
ВысокаяCVSS 8,1Proof of conceptEPSS 17 %fasterxml · jackson-databind6 янв. 2021 г.
- CVE-2020-2867232Наблюдать
MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution.
ВысокаяCVSS 7,2Эксплойта нетEPSS 12 %monocms · monocms7 янв. 2021 г.
- CVE-2021-2324125Наблюдать
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication b
СредняяCVSS 5,3Proof of conceptEPSS 13 %mercusys · mercury x18g firmware7 янв. 2021 г.
- CVE-2020-2457736Наблюдать
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.
ВысокаяCVSS 7,5Эксплойта нетEPSS 19 %dlink · dsl-2888a firmware8 янв. 2021 г.
- CVE-2020-3513154В плане
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/M
КритическаяCVSS 9,8Proof of conceptEPSS 50 %agentejo · cockpit8 янв. 2021 г.
- CVE-2020-2820824Наблюдать
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
СредняяCVSS 5,3Proof of conceptEPSS 10 %rocket.chat · rocket.chat8 янв. 2021 г.
- CVE-2020-1601366На этой неделе
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 2 %google · chrome8 янв. 2021 г.
- CVE-2020-1601769На этой неделе
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process
КритическаяCVSS 9,6KEVГотовый эксплойтEPSS 2 %google · chrome8 янв. 2021 г.
- CVE-2020-1604060На этой неделе
Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption v
СредняяCVSS 6,5Готовый эксплойтEPSS 99 %google · chrome8 янв. 2021 г.
- CVE-2021-312999Срочно
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %laravel · laravel12 янв. 2021 г.
- CVE-2021-164773На этой неделе
Microsoft Defender Remote Code Execution Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 39 %microsoft · windows defender12 янв. 2021 г.
- CVE-2021-167838Наблюдать
Windows Print Spooler Spoofing Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 10 %microsoft · windows 1012 янв. 2021 г.
- CVE-2021-2312448В плане
[20210102] - Core - XSS in mod_breadcrumbs aria-label attribute
СредняяCVSS 6,1Эксплойта нетEPSS 78 %joomla · joomla\!12 янв. 2021 г.
- CVE-2020-3557853В плане
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.
ВысокаяCVSS 7,2Готовый эксплойтEPSS 81 %nagios · nagios xi13 янв. 2021 г.
- CVE-2020-2726542В плане
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All ver
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %ge · industrial gateway server13 янв. 2021 г.
- CVE-2021-2412230Наблюдать
Apache Tomcat information disclosure
СредняяCVSS 5,9Эксплойта нетEPSS 22 %apache · tomcat14 янв. 2021 г.
- CVE-2020-657268На этой неделе
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 10 %google · chrome14 янв. 2021 г.
- CVE-2020-3574939Наблюдать
Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for
ВысокаяCVSS 7,7Proof of conceptEPSS 30 %presstigers · simple board job15 янв. 2021 г.
- CVE-2021-2124355В плане
Pre-Auth Unsafe Deserialization on KubernetesResource
КритическаяCVSS 9,8Эксплойта нетEPSS 54 %onedev project · onedev15 янв. 2021 г.
- CVE-2021-2124261На этой неделе
Pre-Auth Unsafe Deserialization on AttachmentUploadServet
КритическаяCVSS 9,8Эксплойта нетEPSS 74 %onedev project · onedev15 янв. 2021 г.
- CVE-2021-2124645В плане
Pre-Auth Access token leak
ВысокаяCVSS 7,5Proof of conceptEPSS 49 %onedev project · onedev15 янв. 2021 г.
- CVE-2021-2125139Наблюдать
ZipSlip Arbitrary File Upload
ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %onedev project · onedev15 янв. 2021 г.
- CVE-2021-2529442В плане
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution.
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %opencats · opencats18 янв. 2021 г.
- CVE-2020-3619381Срочно
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a relat
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 70 %php · archive tar18 янв. 2021 г.
- CVE-2021-317746В плане
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Pyth
КритическаяCVSS 9,8Эксплойта нетEPSS 24 %python · python19 янв. 2021 г.
- CVE-2020-2334239Наблюдать
A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
ВысокаяCVSS 8,8Proof of conceptEPSS 12 %anchorcms · anchor cms19 янв. 2021 г.
- CVE-2020-1936035Наблюдать
Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to
ВысокаяCVSS 7,5Proof of conceptEPSS 17 %fhem · fhem19 янв. 2021 г.
- CVE-2020-1936456В плане
OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.
ВысокаяCVSS 8,8Эксплойта нетEPSS 70 %open-emr · openemr19 янв. 2021 г.
- CVE-2020-2538529Наблюдать
Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapsh
СредняяCVSS 6,1Эксплойта нетEPSS 16 %nagios · log server19 янв. 2021 г.
- CVE-2021-311045В плане
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_pro
КритическаяCVSS 9,8Proof of conceptEPSS 18 %prestashop · prestashop20 янв. 2021 г.
- CVE-2020-1475661На этой неделе
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components).
КритическаяCVSS 9,8Proof of conceptEPSS 74 %oracle · coherence20 янв. 2021 г.
- CVE-2021-202122Наблюдать
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).
СредняяCVSS 4,9Эксплойта нетEPSS 10 %oracle · mysql20 янв. 2021 г.
- CVE-2021-210949В плане
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).
ВысокаяCVSS 7,2Proof of conceptEPSS 70 %oracle · weblogic server20 янв. 2021 г.
- CVE-2021-211450В плане
Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar).
ВысокаяCVSS 8,2Эксплойта нетEPSS 59 %oracle · common applications calendar20 янв. 2021 г.
- CVE-2020-2568349В плане
A flaw was found in dnsmasq before version 2.83.
СредняяCVSS 5,9Эксплойта нетEPSS 86 %thekelleys · dnsmasq20 янв. 2021 г.
- CVE-2020-2568156В плане
A flaw was found in dnsmasq before version 2.83.
ВысокаяCVSS 8,1Эксплойта нетEPSS 81 %thekelleys · dnsmasq20 янв. 2021 г.
- CVE-2020-2568253В плане
A flaw was found in dnsmasq before 2.83.
ВысокаяCVSS 8,1Эксплойта нетEPSS 70 %thekelleys · dnsmasq20 янв. 2021 г.
- CVE-2020-2568749В плане
A flaw was found in dnsmasq before version 2.83.
СредняяCVSS 5,9Эксплойта нетEPSS 86 %thekelleys · dnsmasq20 янв. 2021 г.
- CVE-2020-2785852В плане
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5.
ВысокаяCVSS 7,5Эксплойта нетEPSS 73 %arcserve · d2d20 янв. 2021 г.
- CVE-2020-1251344В плане
Pepper+Fuchs Comtrol IO-Link Master OS Command Injection
ВысокаяCVSS 8,8Эксплойта нетEPSS 31 %pepperl-fuchs · io-link master 4-eip firmware22 янв. 2021 г.
- CVE-2020-2382639Наблюдать
The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API.
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %assaabloy · yale wipc-303w firmware26 янв. 2021 г.
- CVE-2020-3557648В плане
A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticate
ВысокаяCVSS 8,8Proof of conceptEPSS 42 %tp-link · tl-wr841n firmware26 янв. 2021 г.
- CVE-2021-2287345В плане
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php deli
СредняяCVSS 6,1Proof of conceptEPSS 69 %revive-adserver · revive adserver26 янв. 2021 г.
- CVE-2021-322336Наблюдать
Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.
ВысокаяCVSS 7,5Proof of conceptEPSS 18 %nodered · node-red-dashboard26 янв. 2021 г.
- CVE-2021-327847В плане
Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection .
КритическаяCVSS 9,8Proof of conceptEPSS 25 %local services search engine management system project · local services search engine management system26 янв. 2021 г.
- CVE-2021-329133Наблюдать
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and
ВысокаяCVSS 7,2Proof of conceptEPSS 16 %zen-cart · zen cart26 янв. 2021 г.
- CVE-2021-329737Наблюдать
On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.
ВысокаяCVSS 7,8Proof of conceptEPSS 20 %zyxel · nbg2105 firmware26 янв. 2021 г.
- CVE-2021-315691Срочно
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 99 %sudo project · sudo26 янв. 2021 г.
- CVE-2020-3622155В плане
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, result
ВысокаяCVSS 7,5Эксплойта нетEPSS 84 %openldap · openldap26 янв. 2021 г.
- CVE-2020-3622253В плане
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial
ВысокаяCVSS 7,5Эксплойта нетEPSS 77 %openldap · openldap26 янв. 2021 г.
- CVE-2020-3622753В плане
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in de
ВысокаяCVSS 7,5Эксплойта нетEPSS 77 %openldap · openldap26 янв. 2021 г.
- CVE-2020-3622855В плане
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, r
ВысокаяCVSS 7,5Эксплойта нетEPSS 84 %openldap · openldap26 янв. 2021 г.
- CVE-2020-3623034Наблюдать
A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_elemen
ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %openldap · openldap26 янв. 2021 г.
- CVE-2021-319975На этой неделе
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 20 %onlyoffice · document server26 янв. 2021 г.
- CVE-2021-331747В плане
KLog Server through 2.4.1 allows authenticated command injection.
ВысокаяCVSS 8,8Proof of conceptEPSS 41 %klogserver · klog server26 янв. 2021 г.
- CVE-2021-2611733Наблюдать
ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %apache · activemq27 янв. 2021 г.
- CVE-2020-488854В плане
IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system,
ВысокаяCVSS 8,8Эксплойта нетEPSS 61 %ibm · qradar security information and event manager28 янв. 2021 г.
- CVE-2021-2287429Наблюдать
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.
СредняяCVSS 6,1Эксплойта нетEPSS 18 %revive-adserver · revive adserver28 янв. 2021 г.
- CVE-2021-2287529Наблюдать
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.
СредняяCVSS 6,1Эксплойта нетEPSS 18 %revive-adserver · revive adserver28 янв. 2021 г.
- CVE-2020-3575431Наблюдать
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execut
ВысокаяCVSS 7,2Proof of conceptEPSS 10 %opensolution · quick.cart28 янв. 2021 г.
- CVE-2021-333733Наблюдать
The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicki
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %hide thread content project · hide thread content28 янв. 2021 г.
- CVE-2020-2955785Срочно
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 54 %dlink · dir-825 r1 firmware29 янв. 2021 г.
- CVE-2021-2564665На этой неделе
Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
ВысокаяCVSS 8,8Готовый эксплойтEPSS 99 %apache · druid29 янв. 2021 г.
- CVE-2020-1556848В плане
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root.
КритическаяCVSS 9,8Proof of conceptEPSS 28 %terra-master · tos30 янв. 2021 г.