По дате публикации
Эксплуатируемые и новые серьёзные CVE: ноябрь 2021 г.
71 записей · 11 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
37Наблюдать | CVE-2021-42574Proof of concept | An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.unicode · unicode · CWE-94 | Высокая8,3 | — | 12,8 % | 1 нояб. 2021 г. |
43В плане | CVE-2021-29212Эксплойта нет | A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 hp · ilo amplifier pack · CWE-22 | Критическая9,8 | — | 13,9 % | 1 нояб. 2021 г. |
42В плане | CVE-2021-20136Эксплойта нет | ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite.zohocorp · manageengine log360 · CWE-306 | Критическая9,8 | — | 10,7 % | 1 нояб. 2021 г. |
39Наблюдать | CVE-2021-39341Proof of concept | OptinMonster <= 2.6.4 Unprotected REST-API Endpointsoptinmonster · optinmonster · CWE-285 | Высокая8,2 | — | 21,9 % | 1 нояб. 2021 г. |
41В плане | CVE-2021-42697Proof of concept | Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote atakka · http server · CWE-674 | Высокая7,5 | — | 36,1 % | 2 нояб. 2021 г. |
56В плане | CVE-2021-43267Proof of concept | An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.linux · linux kernel · CWE-1284 | Критическая9,8 | — | 57,8 % | 2 нояб. 2021 г. |
42В плане | CVE-2021-39238Эксплойта нет | Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential bufhp · futuresmart 3 · CWE-120 | Критическая9,8 | — | 11,2 % | 2 нояб. 2021 г. |
50В плане | CVE-2021-41174Proof of concept | XSS vulnerability allowing arbitrary JavaScript executiongrafana · grafana · CWE-79 | Средняя6,1 | — | 85,4 % | 3 нояб. 2021 г. |
22Наблюдать | CVE-2021-38428Эксплойта нет | Delta Electronics DIALinkdeltaww · dialink · CWE-79 | Средняя4,8 | — | 11,4 % | 3 нояб. 2021 г. |
23Наблюдать | CVE-2021-38488Эксплойта нет | Delta Electronics DIALinkdeltaww · dialink · CWE-79 | Средняя4,8 | — | 12,3 % | 3 нояб. 2021 г. |
42В плане | CVE-2021-39906Эксплойта нет | Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vicgitlab · gitlab · CWE-79 | Средняя6,1 | — | 60,7 % | 4 нояб. 2021 г. |
98Срочно | CVE-2021-42237Готовый эксплойт | Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achisitecore · experience platform · CWE-502 | Критическая9,8 | KEV | 97,5 % | 5 нояб. 2021 г. |
44В плане | CVE-2021-42667Proof of concept | A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views.online event booking and reservation system project · online event booking and reservation system · CWE-89 | Критическая9,8 | — | 16,0 % | 5 нояб. 2021 г. |
46В плане | CVE-2021-42669Proof of concept | A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avaengineers online portal project · engineers online portal · CWE-434 | Критическая9,8 | — | 23,2 % | 5 нояб. 2021 г. |
36Наблюдать | CVE-2021-42671Proof of concept | An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploaengineers online portal project · engineers online portal · CWE-425 | Высокая7,5 | — | 19,6 % | 5 нояб. 2021 г. |
46В плане | CVE-2021-43405Proof of concept | An issue was discovered in FusionPBX before 4.5.30.fusionpbx · fusionpbx | Высокая8,8 | — | 35,6 % | 5 нояб. 2021 г. |
45В плане | CVE-2021-31602Proof of concept | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.hitachi · vantara pentaho · CWE-287 | Высокая7,5 | — | 51,6 % | 8 нояб. 2021 г. |
43В плане | CVE-2021-24827Proof of concept | Asgaros Forum < 1.15.13 - Unauthenticated SQL Injectionasgaros · asgaros forum · CWE-89 | Критическая9,8 | — | 12,5 % | 8 нояб. 2021 г. |
40В плане | CVE-2021-38666Proof of concept | Remote Desktop Client Remote Code Execution Vulnerabilitymicrosoft · windows 10 | Высокая8,8 | — | 15,1 % | 9 нояб. 2021 г. |
54В плане | CVE-2021-41349Proof of concept | Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange server | Средняя6,5 | — | 93,4 % | 9 нояб. 2021 г. |
58В плане | CVE-2021-41379Готовый эксплойт | Windows Installer Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-59 | Средняя5,5 | KEV | 19,4 % | 9 нояб. 2021 г. |
82Срочно | CVE-2021-42278Готовый эксплойт | Active Directory Domain Services Elevation of Privilege Vulnerabilitymicrosoft · windows server 2004 | Высокая7,5 | KEV | 73,2 % | 9 нояб. 2021 г. |
83Срочно | CVE-2021-42287Готовый эксплойт | Active Directory Domain Services Elevation of Privilege Vulnerabilitymicrosoft · windows server 2004 | Высокая7,5 | KEV | 77,1 % | 9 нояб. 2021 г. |
74На этой неделе | CVE-2021-42292Готовый эксплойт | Microsoft Excel Security Feature Bypass Vulnerabilitymicrosoft · 365 apps | Высокая7,8 | KEV | 43,0 % | 9 нояб. 2021 г. |
93Срочно | CVE-2021-42321Готовый эксплойт | Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange server | Высокая8,8 | KEV | 91,7 % | 9 нояб. 2021 г. |
44В плане | CVE-2021-43136Proof of concept | An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to tformalms · formalms · CWE-798 | Критическая9,8 | — | 15,7 % | 10 нояб. 2021 г. |
42В плане | CVE-2021-3060Proof of concept | PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)paloaltonetworks · prisma access · CWE-78 | Высокая8,1 | — | 32,5 % | 10 нояб. 2021 г. |
45В плане | CVE-2021-3064Proof of concept | PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfacespaloaltonetworks · pan-os · CWE-121 | Критическая9,8 | — | 20,1 % | 10 нояб. 2021 г. |
38Наблюдать | CVE-2021-22048Эксплойта нет | The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.vmware · cloud foundation | Высокая8,8 | — | 10,2 % | 10 нояб. 2021 г. |
48В плане | CVE-2021-33618Эксплойта нет | Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY eldolibarr · dolibarr erp\/crm · CWE-79 | Средняя6,1 | — | 79,2 % | 10 нояб. 2021 г. |
58В плане | CVE-2021-41081Proof of concept | Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.zohocorp · manageengine network configuration manager · CWE-89 | Критическая9,8 | — | 64,0 % | 11 нояб. 2021 г. |
60На этой неделе | CVE-2021-42847Готовый эксплойт | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.zohocorp · manageengine adaudit plus | Критическая9,8 | — | 70,3 % | 11 нояб. 2021 г. |
37Наблюдать | CVE-2002-20001Proof of concept | The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not pubbalasys · dheater · CWE-400 | Высокая7,5 | — | 24,6 % | 11 нояб. 2021 г. |
48В плане | CVE-2021-21699Эксплойта нет | Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, jenkins · active choices · CWE-79 | Средняя5,4 | — | 88,4 % | 12 нояб. 2021 г. |
35Наблюдать | CVE-2021-43496Proof of concept | Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability.clustering project · clustering · CWE-22 | Высокая7,5 | — | 15,9 % | 12 нояб. 2021 г. |
53В плане | CVE-2021-3577Proof of concept | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attbinatoneglobal · halo\+ camera firmware · CWE-78 | Высокая8,8 | — | 60,1 % | 12 нояб. 2021 г. |
36Наблюдать | CVE-2021-3840Эксплойта нет | A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote colenovo · antilles · CWE-427 | Высокая8,8 | — | 2,0 % | 12 нояб. 2021 г. |
62На этой неделе | CVE-2021-41653Proof of concept | The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code executiontp-link · tl-wr840n firmware · CWE-94 | Критическая9,8 | — | 76,0 % | 13 нояб. 2021 г. |
45В плане | CVE-2021-43617Proof of concept | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/Vallaravel · framework · CWE-434 | Критическая9,8 | — | 19,8 % | 14 нояб. 2021 г. |
60На этой неделе | CVE-2020-16152Готовый эксплойт | The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackersextremenetworks · aerohive netconfig · CWE-829 | Критическая9,8 | — | 35,5 % | 14 нояб. 2021 г. |
59В плане | CVE-2021-41765Эксплойта нет | A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attmontala · resourcespace · CWE-89 | Критическая9,8 | — | 67,8 % | 15 нояб. 2021 г. |
58В плане | CVE-2021-41950Эксплойта нет | A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on tmontala · resourcespace · CWE-22 | Критическая9,1 | — | 74,8 % | 15 нояб. 2021 г. |
47В плане | CVE-2021-41951Proof of concept | ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php vimontala · resourcespace · CWE-79 | Средняя6,1 | — | 77,8 % | 15 нояб. 2021 г. |
53В плане | CVE-2021-41266Proof of concept | Authentication bypass issue in the Operator Consolemin · minio console · CWE-306 | Критическая9,8 | — | 48,1 % | 15 нояб. 2021 г. |
52В плане | CVE-2021-37580Proof of concept | Apache ShenYu Admin bypass JWT authenticationapache · shenyu · CWE-287 | Критическая9,8 | — | 41,8 % | 16 нояб. 2021 г. |
43В плане | CVE-2021-3958Эксплойта нет | SQL Injection Vulnerability in Ipack SCADA Softwareipack · scada automation · CWE-89 | Критическая9,8 | — | 14,5 % | 16 нояб. 2021 г. |
59В плане | CVE-2021-42362Готовый эксплойт | WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Uploadwordpress popular posts project · wordpress popular posts · CWE-434 | Высокая8,8 | — | 79,8 % | 17 нояб. 2021 г. |
89Срочно | CVE-2021-41277Готовый эксплойт | GeoJSON URL validation can expose server files and environment variables to unauthorized usersmetabase · metabase · CWE-200 | Высокая7,5 | KEV | 97,1 % | 17 нояб. 2021 г. |
90Срочно | CVE-2021-44026Готовый эксплойт | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.roundcube · webmail · CWE-89 | Критическая9,8 | KEV | 69,8 % | 19 нояб. 2021 г. |
39Наблюдать | CVE-2021-22053Proof of concept | Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted vmware · spring cloud netflix · CWE-94 | Высокая8,8 | — | 13,2 % | 19 нояб. 2021 г. |
42В плане | CVE-2021-43555Эксплойта нет | mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulmyscada · mydesigner · CWE-23 | Высокая7,8 | — | 38,2 % | 19 нояб. 2021 г. |
34Наблюдать | CVE-2021-38146Proof of concept | The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute pwipro · holmes · CWE-22 | Высокая7,5 | — | 11,9 % | 22 нояб. 2021 г. |
34Наблюдать | CVE-2021-43557Proof of concept | Path traversal in request_uri variableapache · apisix · CWE-77 | Высокая7,5 | — | 12,9 % | 22 нояб. 2021 г. |
43В плане | CVE-2021-42727Эксплойта нет | Adobe Bridge Buffer Overflow Arbitrary code executionadobe · robohelp server · CWE-787 | Высокая7,8 | — | 39,4 % | 22 нояб. 2021 г. |
32Наблюдать | CVE-2021-24891Proof of concept | Elementor < 3.4.8 - DOM Cross-Site-Scriptingelementor · website builder · CWE-79 | Средняя6,1 | — | 25,1 % | 23 нояб. 2021 г. |
41В плане | CVE-2021-36299Эксплойта нет | Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability.dell · emc idrac9 firmware · CWE-89 | Высокая8,1 | — | 29,6 % | 23 нояб. 2021 г. |
42В плане | CVE-2021-36300Эксплойта нет | iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.dell · emc idrac9 firmware · CWE-89 | Высокая8,2 | — | 33,3 % | 23 нояб. 2021 г. |
36Наблюдать | CVE-2021-36301Эксплойта нет | Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm.dell · emc idrac8 firmware · CWE-121 | Высокая7,2 | — | 27,6 % | 23 нояб. 2021 г. |
60На этой неделе | CVE-2021-38000Готовый эксплойт | Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitragoogle · chrome · CWE-601 | Средняя6,1 | KEV | 4,9 % | 23 нояб. 2021 г. |
43В плане | CVE-2021-38001Proof of concept | Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted Hgoogle · chrome · CWE-843 | Высокая8,8 | — | 26,7 % | 23 нояб. 2021 г. |
77На этой неделе | CVE-2021-38003Готовый эксплойт | Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption vgoogle · chrome · CWE-755 | Высокая8,8 | KEV | 38,5 % | 23 нояб. 2021 г. |
40В плане | CVE-2021-42783Эксплойта нет | Missing Authentication in debug_post_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4dlink · dwr-932c e1 firmware · CWE-306 | Критическая9,8 | — | 3,9 % | 23 нояб. 2021 г. |
46В плане | CVE-2021-43778Proof of concept | Path traversal in GLPI barcode pluginglpi-project · barcode · CWE-22 | Высокая7,5 | — | 52,6 % | 24 нояб. 2021 г. |
48В плане | CVE-2021-44223Эксплойта нет | WordPress before 5.8 lacks support for the Update URI plugin header.wordpress · wordpress | Критическая9,8 | — | 28,9 % | 25 нояб. 2021 г. |
97Срочно | CVE-2021-44077Готовый эксплойт | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unzohocorp · manageengine servicedesk plus · CWE-306 | Критическая9,8 | KEV | 93,2 % | 29 нояб. 2021 г. |
29Наблюдать | CVE-2021-21707Proof of concept | Special characters break path parsing in XML functionsphp · php · CWE-159 | Средняя5,3 | — | 25,3 % | 29 нояб. 2021 г. |
46В плане | CVE-2021-38147Proof of concept | Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitiwipro · holmes · CWE-306 | Высокая7,5 | — | 53,0 % | 29 нояб. 2021 г. |
43В плане | CVE-2021-24915Proof of concept | Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosurecontest gallery · contest gallery · CWE-89 | Критическая9,8 | — | 12,0 % | 29 нояб. 2021 г. |
28Наблюдать | CVE-2021-43788Эксплойта нет | Path traversal in translator module of NobeBBnodebb · nodebb · CWE-22 | Средняя5,0 | — | 25,8 % | 29 нояб. 2021 г. |
54В плане | CVE-2021-44427Proof of concept | An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers trosariosis · rosariosis · CWE-89 | Критическая9,8 | — | 50,6 % | 29 нояб. 2021 г. |
45В плане | CVE-2021-43319Эксплойта нет | Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping funczohocorp · manageengine network configuration manager · CWE-77 | Критическая9,8 | — | 21,3 % | 30 нояб. 2021 г. |
- CVE-2021-4257437Наблюдать
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.
ВысокаяCVSS 8,3Proof of conceptEPSS 12 %unicode · unicode1 нояб. 2021 г.
- CVE-2021-2921243В плане
A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90
КритическаяCVSS 9,8Эксплойта нетEPSS 13 %hp · ilo amplifier pack1 нояб. 2021 г.
- CVE-2021-2013642В плане
ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite.
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %zohocorp · manageengine log3601 нояб. 2021 г.
- CVE-2021-3934139Наблюдать
OptinMonster <= 2.6.4 Unprotected REST-API Endpoints
ВысокаяCVSS 8,2Proof of conceptEPSS 21 %optinmonster · optinmonster1 нояб. 2021 г.
- CVE-2021-4269741В плане
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote at
ВысокаяCVSS 7,5Proof of conceptEPSS 36 %akka · http server2 нояб. 2021 г.
- CVE-2021-4326756В плане
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.
КритическаяCVSS 9,8Proof of conceptEPSS 57 %linux · linux kernel2 нояб. 2021 г.
- CVE-2021-3923842В плане
Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buf
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %hp · futuresmart 32 нояб. 2021 г.
- CVE-2021-4117450В плане
XSS vulnerability allowing arbitrary JavaScript execution
СредняяCVSS 6,1Proof of conceptEPSS 85 %grafana · grafana3 нояб. 2021 г.
- CVE-2021-3842822Наблюдать
Delta Electronics DIALink
СредняяCVSS 4,8Эксплойта нетEPSS 11 %deltaww · dialink3 нояб. 2021 г.
- CVE-2021-3848823Наблюдать
Delta Electronics DIALink
СредняяCVSS 4,8Эксплойта нетEPSS 12 %deltaww · dialink3 нояб. 2021 г.
- CVE-2021-3990642В плане
Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vic
СредняяCVSS 6,1Эксплойта нетEPSS 60 %gitlab · gitlab4 нояб. 2021 г.
- CVE-2021-4223798Срочно
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achi
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 97 %sitecore · experience platform5 нояб. 2021 г.
- CVE-2021-4266744В плане
A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views.
КритическаяCVSS 9,8Proof of conceptEPSS 16 %online event booking and reservation system project · online event booking and reservation system5 нояб. 2021 г.
- CVE-2021-4266946В плане
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the ava
КритическаяCVSS 9,8Proof of conceptEPSS 23 %engineers online portal project · engineers online portal5 нояб. 2021 г.
- CVE-2021-4267136Наблюдать
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploa
ВысокаяCVSS 7,5Proof of conceptEPSS 19 %engineers online portal project · engineers online portal5 нояб. 2021 г.
- CVE-2021-4340546В плане
An issue was discovered in FusionPBX before 4.5.30.
ВысокаяCVSS 8,8Proof of conceptEPSS 35 %fusionpbx · fusionpbx5 нояб. 2021 г.
- CVE-2021-3160245В плане
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
ВысокаяCVSS 7,5Proof of conceptEPSS 51 %hitachi · vantara pentaho8 нояб. 2021 г.
- CVE-2021-2482743В плане
Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 12 %asgaros · asgaros forum8 нояб. 2021 г.
- CVE-2021-3866640В плане
Remote Desktop Client Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 15 %microsoft · windows 109 нояб. 2021 г.
- CVE-2021-4134954В плане
Microsoft Exchange Server Spoofing Vulnerability
СредняяCVSS 6,5Proof of conceptEPSS 93 %microsoft · exchange server9 нояб. 2021 г.
- CVE-2021-4137958В плане
Windows Installer Elevation of Privilege Vulnerability
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 19 %microsoft · windows 10 15079 нояб. 2021 г.
- CVE-2021-4227882Срочно
Active Directory Domain Services Elevation of Privilege Vulnerability
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 73 %microsoft · windows server 20049 нояб. 2021 г.
- CVE-2021-4228783Срочно
Active Directory Domain Services Elevation of Privilege Vulnerability
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 77 %microsoft · windows server 20049 нояб. 2021 г.
- CVE-2021-4229274На этой неделе
Microsoft Excel Security Feature Bypass Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 43 %microsoft · 365 apps9 нояб. 2021 г.
- CVE-2021-4232193Срочно
Microsoft Exchange Server Remote Code Execution Vulnerability
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 91 %microsoft · exchange server9 нояб. 2021 г.
- CVE-2021-4313644В плане
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to t
КритическаяCVSS 9,8Proof of conceptEPSS 15 %formalms · formalms10 нояб. 2021 г.
- CVE-2021-306042В плане
PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)
ВысокаяCVSS 8,1Proof of conceptEPSS 32 %paloaltonetworks · prisma access10 нояб. 2021 г.
- CVE-2021-306445В плане
PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces
КритическаяCVSS 9,8Proof of conceptEPSS 20 %paloaltonetworks · pan-os10 нояб. 2021 г.
- CVE-2021-2204838Наблюдать
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.
ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %vmware · cloud foundation10 нояб. 2021 г.
- CVE-2021-3361848В плане
Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY el
СредняяCVSS 6,1Эксплойта нетEPSS 79 %dolibarr · dolibarr erp\/crm10 нояб. 2021 г.
- CVE-2021-4108158В плане
Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.
КритическаяCVSS 9,8Proof of conceptEPSS 64 %zohocorp · manageengine network configuration manager11 нояб. 2021 г.
- CVE-2021-4284760На этой неделе
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
КритическаяCVSS 9,8Готовый эксплойтEPSS 70 %zohocorp · manageengine adaudit plus11 нояб. 2021 г.
- CVE-2002-2000137Наблюдать
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not pub
ВысокаяCVSS 7,5Proof of conceptEPSS 24 %balasys · dheater11 нояб. 2021 г.
- CVE-2021-2169948В плане
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters,
СредняяCVSS 5,4Эксплойта нетEPSS 88 %jenkins · active choices12 нояб. 2021 г.
- CVE-2021-4349635Наблюдать
Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability.
ВысокаяCVSS 7,5Proof of conceptEPSS 15 %clustering project · clustering12 нояб. 2021 г.
- CVE-2021-357753В плане
An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an att
ВысокаяCVSS 8,8Proof of conceptEPSS 60 %binatoneglobal · halo\+ camera firmware12 нояб. 2021 г.
- CVE-2021-384036Наблюдать
A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote co
ВысокаяCVSS 8,8Эксплойта нетEPSS 2 %lenovo · antilles12 нояб. 2021 г.
- CVE-2021-4165362На этой неделе
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution
КритическаяCVSS 9,8Proof of conceptEPSS 76 %tp-link · tl-wr840n firmware13 нояб. 2021 г.
- CVE-2021-4361745В плане
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/Val
КритическаяCVSS 9,8Proof of conceptEPSS 19 %laravel · framework14 нояб. 2021 г.
- CVE-2020-1615260На этой неделе
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers
КритическаяCVSS 9,8Готовый эксплойтEPSS 35 %extremenetworks · aerohive netconfig14 нояб. 2021 г.
- CVE-2021-4176559В плане
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated att
КритическаяCVSS 9,8Эксплойта нетEPSS 67 %montala · resourcespace15 нояб. 2021 г.
- CVE-2021-4195058В плане
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on t
КритическаяCVSS 9,1Эксплойта нетEPSS 74 %montala · resourcespace15 нояб. 2021 г.
- CVE-2021-4195147В плане
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php vi
СредняяCVSS 6,1Proof of conceptEPSS 77 %montala · resourcespace15 нояб. 2021 г.
- CVE-2021-4126653В плане
Authentication bypass issue in the Operator Console
КритическаяCVSS 9,8Proof of conceptEPSS 48 %min · minio console15 нояб. 2021 г.
- CVE-2021-3758052В плане
Apache ShenYu Admin bypass JWT authentication
КритическаяCVSS 9,8Proof of conceptEPSS 41 %apache · shenyu16 нояб. 2021 г.
- CVE-2021-395843В плане
SQL Injection Vulnerability in Ipack SCADA Software
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %ipack · scada automation16 нояб. 2021 г.
- CVE-2021-4236259В плане
WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload
ВысокаяCVSS 8,8Готовый эксплойтEPSS 79 %wordpress popular posts project · wordpress popular posts17 нояб. 2021 г.
- CVE-2021-4127789Срочно
GeoJSON URL validation can expose server files and environment variables to unauthorized users
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 97 %metabase · metabase17 нояб. 2021 г.
- CVE-2021-4402690Срочно
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 69 %roundcube · webmail19 нояб. 2021 г.
- CVE-2021-2205339Наблюдать
Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %vmware · spring cloud netflix19 нояб. 2021 г.
- CVE-2021-4355542В плане
mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vul
ВысокаяCVSS 7,8Эксплойта нетEPSS 38 %myscada · mydesigner19 нояб. 2021 г.
- CVE-2021-3814634Наблюдать
The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute p
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %wipro · holmes22 нояб. 2021 г.
- CVE-2021-4355734Наблюдать
Path traversal in request_uri variable
ВысокаяCVSS 7,5Proof of conceptEPSS 12 %apache · apisix22 нояб. 2021 г.
- CVE-2021-4272743В плане
Adobe Bridge Buffer Overflow Arbitrary code execution
ВысокаяCVSS 7,8Эксплойта нетEPSS 39 %adobe · robohelp server22 нояб. 2021 г.
- CVE-2021-2489132Наблюдать
Elementor < 3.4.8 - DOM Cross-Site-Scripting
СредняяCVSS 6,1Proof of conceptEPSS 25 %elementor · website builder23 нояб. 2021 г.
- CVE-2021-3629941В плане
Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability.
ВысокаяCVSS 8,1Эксплойта нетEPSS 29 %dell · emc idrac9 firmware23 нояб. 2021 г.
- CVE-2021-3630042В плане
iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.
ВысокаяCVSS 8,2Эксплойта нетEPSS 33 %dell · emc idrac9 firmware23 нояб. 2021 г.
- CVE-2021-3630136Наблюдать
Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm.
ВысокаяCVSS 7,2Эксплойта нетEPSS 27 %dell · emc idrac8 firmware23 нояб. 2021 г.
- CVE-2021-3800060На этой неделе
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitra
СредняяCVSS 6,1KEVГотовый эксплойтEPSS 4 %google · chrome23 нояб. 2021 г.
- CVE-2021-3800143В плане
Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted H
ВысокаяCVSS 8,8Proof of conceptEPSS 26 %google · chrome23 нояб. 2021 г.
- CVE-2021-3800377На этой неделе
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption v
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 38 %google · chrome23 нояб. 2021 г.
- CVE-2021-4278340В плане
Missing Authentication in debug_post_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4
КритическаяCVSS 9,8Эксплойта нетEPSS 3 %dlink · dwr-932c e1 firmware23 нояб. 2021 г.
- CVE-2021-4377846В плане
Path traversal in GLPI barcode plugin
ВысокаяCVSS 7,5Proof of conceptEPSS 52 %glpi-project · barcode24 нояб. 2021 г.
- CVE-2021-4422348В плане
WordPress before 5.8 lacks support for the Update URI plugin header.
КритическаяCVSS 9,8Эксплойта нетEPSS 28 %wordpress · wordpress25 нояб. 2021 г.
- CVE-2021-4407797Срочно
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 93 %zohocorp · manageengine servicedesk plus29 нояб. 2021 г.
- CVE-2021-2170729Наблюдать
Special characters break path parsing in XML functions
СредняяCVSS 5,3Proof of conceptEPSS 25 %php · php29 нояб. 2021 г.
- CVE-2021-3814746В плане
Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti
ВысокаяCVSS 7,5Proof of conceptEPSS 53 %wipro · holmes29 нояб. 2021 г.
- CVE-2021-2491543В плане
Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
КритическаяCVSS 9,8Proof of conceptEPSS 12 %contest gallery · contest gallery29 нояб. 2021 г.
- CVE-2021-4378828Наблюдать
Path traversal in translator module of NobeBB
СредняяCVSS 5,0Эксплойта нетEPSS 25 %nodebb · nodebb29 нояб. 2021 г.
- CVE-2021-4442754В плане
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers t
КритическаяCVSS 9,8Proof of conceptEPSS 50 %rosariosis · rosariosis29 нояб. 2021 г.
- CVE-2021-4331945В плане
Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping func
КритическаяCVSS 9,8Эксплойта нетEPSS 21 %zohocorp · manageengine network configuration manager30 нояб. 2021 г.