По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2024 г.
185 записей · 15 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
25Наблюдать | CVE-2023-6000Proof of concept | Popup Builder < 4.2.3 - Unauthenticated Stored XSSsygnoos · popup builder · CWE-79 | Средняя6,1 | — | 1,9 % | 1 янв. 2024 г. |
31Наблюдать | CVE-2023-6421Proof of concept | Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leakw3eden · download manager · CWE-522 | Высокая7,5 | — | 2,4 % | 1 янв. 2024 г. |
39Наблюдать | CVE-2023-50094Proof of concept | reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.yogeshojha · rengine · CWE-78 | Высокая8,8 | — | 13,5 % | 1 янв. 2024 г. |
45В плане | CVE-2024-0195Proof of concept | spider-flow FunctionController.java FunctionService.saveFunction code injectionssssssss · spider-flow · CWE-94 | Критическая9,8 | — | 19,4 % | 2 янв. 2024 г. |
40В плане | CVE-2024-21907Proof of concept | Improper Handling of Exceptional Conditions in Newtonsoft.Jsonnewtonsoft · json.net · CWE-755 | Высокая7,5 | — | 32,9 % | 3 янв. 2024 г. |
31Наблюдать | CVE-2024-21633Proof of concept | Arbitrary file write on Decodingapktool · apktool · CWE-22 | Высокая7,8 | — | 1,3 % | 3 янв. 2024 г. |
51В плане | CVE-2023-49442Эксплойта нет | Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POSjeecg · jeecg · CWE-502 | Критическая9,8 | — | 38,5 % | 3 янв. 2024 г. |
38Наблюдать | CVE-2024-0223Эксплойта нет | Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via google · chrome · CWE-787 | Высокая8,8 | — | 10,1 % | 3 янв. 2024 г. |
18Наблюдать | CVE-2024-21641Proof of concept | Flarum's Logout Route allows open redirectsflarum · flarum · CWE-601 | Средняя4,7 | — | 1,0 % | 5 янв. 2024 г. |
44В плане | CVE-2024-0264Эксплойта нет | SourceCodester Clinic Queuing System LoginRegistration.php authorizationoretnom23 · clinic queuing system · CWE-639 | Критическая9,8 | — | 18,2 % | 7 янв. 2024 г. |
41В плане | CVE-2024-0265Эксплойта нет | SourceCodester Clinic Queuing System GET Parameter index.php file inclusionoretnom23 · clinic queuing system · CWE-73 | Высокая8,8 | — | 20,9 % | 7 янв. 2024 г. |
39Наблюдать | CVE-2023-7212Эксплойта нет | DeDeCMS Backend file_class.php unrestricted uploaddedecms · dedecms · CWE-434 | Критическая9,8 | — | 0,5 % | 7 янв. 2024 г. |
39Наблюдать | CVE-2024-0287Эксплойта нет | Kashipara Food Management System itemBillPdf.php sql injectionkashipara · food management system · CWE-89 | Критическая9,8 | — | 0,7 % | 7 янв. 2024 г. |
50В плане | CVE-2024-0305Proof of concept | Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosurencast project · ncast · CWE-200 | Высокая7,5 | — | 66,9 % | 8 янв. 2024 г. |
43В плане | CVE-2024-21644Proof of concept | pyLoad unauthenticated flask configuration leakagepyload · pyload · CWE-284 | Высокая7,5 | — | 42,4 % | 8 янв. 2024 г. |
28Наблюдать | CVE-2024-21645Proof of concept | pyLoad Log Injectionpyload · pyload · CWE-74 | Средняя5,3 | — | 24,6 % | 8 янв. 2024 г. |
48В плане | CVE-2023-47211Proof of concept | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258.zohocorp · manageengine firewall analyzer · CWE-22 | Высокая8,6 | — | 47,0 % | 8 янв. 2024 г. |
67На этой неделе | CVE-2024-21650Proof of concept | XWiki Remote Code Execution vulnerability via user registrationxwiki · xwiki · CWE-95 | Критическая9,8 | — | 93,4 % | 8 янв. 2024 г. |
28Наблюдать | CVE-2022-3328Proof of concept | Race condition in snap-confine's must_mkdir_and_open_with_perms()canonical · snapd · CWE-362 | Высокая7,0 | — | 0,3 % | 8 янв. 2024 г. |
42В плане | CVE-2023-6505Proof of concept | Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposurecodexonics · prime mover · CWE-200 | Высокая7,5 | — | 39,8 % | 8 янв. 2024 г. |
31Наблюдать | CVE-2023-6750Proof of concept | Clone < 2.4.3 - Unauthenticated Backup Downloadbackupbliss · clone · CWE-200 | Высокая7,5 | — | 1,9 % | 8 янв. 2024 г. |
26Наблюдать | CVE-2023-52271Proof of concept | The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via atopazevolution · antifraud | Средняя6,5 | — | 0,3 % | 8 янв. 2024 г. |
41В плане | CVE-2022-45354Proof of concept | WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposurewpchill · download monitor · CWE-200 | Высокая7,5 | — | 38,0 % | 8 янв. 2024 г. |
64На этой неделе | CVE-2022-2586Готовый эксплойт | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that siemens · simatic s7-1500 tm mfp firmware · CWE-416 | Высокая7,8 | KEV | 10,2 % | 8 янв. 2024 г. |
33Наблюдать | CVE-2022-2588Proof of concept | It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freelinux · linux kernel · CWE-416 | Высокая7,8 | — | 5,8 % | 8 янв. 2024 г. |
28Наблюдать | CVE-2022-2602Proof of concept | io_uring UAF, Unix SCM garbage collectionlinux · linux kernel · CWE-416 | Высокая7,0 | — | 1,4 % | 8 янв. 2024 г. |
40В плане | CVE-2023-50643Proof of concept | An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspevernote · evernote | Критическая9,8 | — | 1,6 % | 8 янв. 2024 г. |
45В плане | CVE-2023-49237Эксплойта нет | An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices.trendnet · tv-ip1314pi firmware · CWE-77 | Критическая9,8 | — | 18,5 % | 9 янв. 2024 г. |
58В плане | CVE-2022-48618Готовый эксплойт | The issue was addressed with improved checks.apple · ipados · CWE-367 | Высокая7,0 | KEV | 0,4 % | 9 янв. 2024 г. |
32Наблюдать | CVE-2024-20656Proof of concept | Visual Studio Elevation of Privilege Vulnerabilitymicrosoft · visual studio · CWE-59 | Высокая7,8 | — | 3,9 % | 9 янв. 2024 г. |
27Наблюдать | CVE-2024-20666Proof of concept | BitLocker Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-20 | Средняя6,6 | — | 3,0 % | 9 янв. 2024 г. |
40В плане | CVE-2024-20674Proof of concept | Windows Kerberos Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-305 | Высокая8,8 | — | 17,1 % | 9 янв. 2024 г. |
30Наблюдать | CVE-2024-20696Proof of concept | Windows libarchive Remote Code Execution Vulnerabilitymicrosoft · windows 10 1809 · CWE-122 | Высокая7,3 | — | 3,1 % | 9 янв. 2024 г. |
51В плане | CVE-2024-20697Эксплойта нет | Windows libarchive Remote Code Execution Vulnerabilitymicrosoft · windows 11 22h2 · CWE-122 | Высокая7,3 | — | 72,1 % | 9 янв. 2024 г. |
34Наблюдать | CVE-2024-20698Proof of concept | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-190 | Высокая7,8 | — | 8,6 % | 9 янв. 2024 г. |
17Наблюдать | CVE-2024-21305Proof of concept | Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1809 · CWE-732 | Средняя4,4 | — | 1,4 % | 9 янв. 2024 г. |
24Наблюдать | CVE-2024-21306Proof of concept | Microsoft Bluetooth Driver Spoofing Vulnerabilitymicrosoft · windows 10 21h2 · CWE-306 | Средняя5,7 | — | 5,7 % | 9 янв. 2024 г. |
34Наблюдать | CVE-2024-21310Эксплойта нет | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-197 | Высокая7,8 | — | 11,5 % | 9 янв. 2024 г. |
44В плане | CVE-2024-21318Эксплойта нет | Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 | Высокая8,8 | — | 30,8 % | 9 янв. 2024 г. |
33Наблюдать | CVE-2024-21320Proof of concept | Windows Themes Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-200 | Средняя6,5 | — | 22,6 % | 9 янв. 2024 г. |
61На этой неделе | CVE-2024-0352Proof of concept | Likeshop HTTP POST Request File.php userFormImage unrestricted uploadlikeshop · likeshop · CWE-434 | Критическая9,8 | — | 72,9 % | 9 янв. 2024 г. |
57В плане | CVE-2023-31446Proof of concept | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.cassianetworks · xc1000 firmware · CWE-77 | Критическая9,8 | — | 61,0 % | 9 янв. 2024 г. |
39Наблюдать | CVE-2024-0364Эксплойта нет | PHPGurukul Hospital Management System query-details.php sql injectionphpgurukul · hospital management system · CWE-89 | Критическая9,8 | — | 0,5 % | 9 янв. 2024 г. |
35Наблюдать | CVE-2023-49471Proof of concept | Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter beforebarassistant · bar assistant · CWE-918 | Высокая8,8 | — | 1,1 % | 10 янв. 2024 г. |
25Наблюдать | CVE-2023-48728Proof of concept | A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master comwwbn · avideo · CWE-79 | Средняя6,1 | — | 2,2 % | 10 янв. 2024 г. |
28Наблюдать | CVE-2023-48783Эксплойта нет | An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 andfortinet · fortiportal · CWE-639 | Средняя5,4 | — | 22,2 % | 10 янв. 2024 г. |
39Наблюдать | CVE-2023-31488Proof of concept | Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Ciscocisco · ironport email security appliance · CWE-787 | Критическая9,8 | — | 0,7 % | 10 янв. 2024 г. |
48В плане | CVE-2023-51126Proof of concept | Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value paramflir · flir ax8 firmware · CWE-77 | Критическая9,8 | — | 31,0 % | 10 янв. 2024 г. |
30Наблюдать | CVE-2023-51127Proof of concept | FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction.flir · flir ax8 firmware · CWE-22 | Высокая7,5 | — | 1,2 % | 10 янв. 2024 г. |
13Наблюдать | CVE-2023-28197Proof of concept | An access issue was addressed with additional sandbox restrictions.apple · macos · CWE-284 | Низкая3,3 | — | 0,3 % | 10 янв. 2024 г. |
62На этой неделе | CVE-2023-41974Готовый эксплойт | A use-after-free issue was addressed with improved memory management.apple · ipados · CWE-416 | Высокая7,8 | KEV | 1,9 % | 10 янв. 2024 г. |
22Наблюдать | CVE-2023-42829Proof of concept | The issue was addressed with additional restrictions on the observability of app states.apple · macos · CWE-200 | Средняя5,5 | — | 0,3 % | 10 янв. 2024 г. |
46В плане | CVE-2023-51123Эксплойта нет | An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the sedlink · dir-815 firmware · CWE-78 | Критическая9,8 | — | 24,3 % | 10 янв. 2024 г. |
32Наблюдать | CVE-2023-51073Proof of concept | An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/updabuffalo · ls210d firmware | Высокая8,1 | — | 1,3 % | 10 янв. 2024 г. |
26Наблюдать | CVE-2023-4372Эксплойта нет | LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelitespeedtech · litespeed cache · CWE-79 | Средняя5,4 | — | 16,7 % | 11 янв. 2024 г. |
31Наблюдать | CVE-2023-6266Proof of concept | Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposurebackupbliss · backup migration · CWE-200 | Высокая7,5 | — | 2,0 % | 11 янв. 2024 г. |
45В плане | CVE-2023-6567Proof of concept | LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_bythimpress · learnpress · CWE-89 | Высокая7,5 | — | 51,3 % | 11 янв. 2024 г. |
42В плане | CVE-2023-6634Proof of concept | LearnPress <= 4.2.5.7 - Command Injectionthimpress · learnpress · CWE-88 | Критическая9,8 | — | 8,5 % | 11 янв. 2024 г. |
66На этой неделе | CVE-2023-6875Готовый эксплойт | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app APIwpexperts · post smtp · CWE-639 | Критическая9,8 | — | 90,3 % | 11 янв. 2024 г. |
12Наблюдать | CVE-2023-20573Proof of concept | Debug Exception Delivery in Secure Nested Pagingamd · epyc 7763 firmware · CWE-693 | Низкая3,2 | — | 0,2 % | 11 янв. 2024 г. |
36Наблюдать | CVE-2024-22198Proof of concept | Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)nginxui · nginx ui · CWE-77 | Высокая8,8 | — | 4,0 % | 11 янв. 2024 г. |
34Наблюдать | CVE-2023-46474Proof of concept | File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uplosigb · pmb · CWE-434 | Высокая7,2 | — | 21,1 % | 11 янв. 2024 г. |
44В плане | CVE-2024-21591Эксплойта нет | Junos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code Executionjuniper · junos · CWE-787 | Критическая9,8 | — | 17,6 % | 11 янв. 2024 г. |
17Наблюдать | CVE-2023-40362Proof of concept | An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023.centralsquare · click2gov building permit · CWE-862 | Средняя4,3 | — | 0,6 % | 12 янв. 2024 г. |
60На этой неделе | CVE-2023-50919Готовый эксплойт | An issue was discovered on GL.iNet devices before version 4.5.0.gl-inet · gl-ax1800 firmware · CWE-287 | Критическая9,8 | — | 47,8 % | 12 янв. 2024 г. |
97Срочно | CVE-2023-7028Готовый эксплойт | Weak Password Recovery Mechanism for Forgotten Password in GitLabgitlab · gitlab · CWE-640 | Критическая9,8 | KEV | 94,4 % | 12 янв. 2024 г. |
96Срочно | CVE-2024-21887Готовый эксплойт | A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an autivanti · connect secure · CWE-77 | Критическая9,1 | KEV | 99,9 % | 12 янв. 2024 г. |
92Срочно | CVE-2023-46805Готовый эксплойт | An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to accivanti · connect secure · CWE-287 | Высокая8,2 | KEV | 99,9 % | 12 янв. 2024 г. |
9Наблюдать | CVE-2024-0230Proof of concept | A session management issue was addressed with improved checks.apple · magic keyboard firmware | Низкая2,4 | — | 1,2 % | 12 янв. 2024 г. |
21Наблюдать | CVE-2023-50072Proof of concept | A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an autheopenkm · openkm · CWE-79 | Средняя5,4 | — | 0,6 % | 12 янв. 2024 г. |
35Наблюдать | CVE-2024-0522Эксплойта нет | Allegro RomPager HTTP POST Request cross-site request forgeryallegrosoft · rompager · CWE-352 | Высокая8,8 | — | 0,2 % | 14 янв. 2024 г. |
39Наблюдать | CVE-2024-0527Эксплойта нет | CXBSoft Url-shorting HTTP POST Request update_go.php sql injectioncxbsoft · url-shorting · CWE-89 | Критическая9,8 | — | 0,6 % | 14 янв. 2024 г. |
60На этой неделе | CVE-2024-0546Готовый эксплойт | EasyFTP LIST Command denial of serviceeasyftp · easyftp · CWE-404 | Высокая7,5 | — | 6,8 % | 15 янв. 2024 г. |
47В плане | CVE-2023-50290Proof of concept | Apache Solr: Host environment variables are published via the Metrics APIapache · solr · CWE-200 | Средняя6,5 | — | 68,4 % | 15 янв. 2024 г. |
32Наблюдать | CVE-2023-6620Эксплойта нет | Post SMTP < 2.8.7 - Admin+ SQL Injectionwpexperts · post smtp · CWE-89 | Высокая7,2 | — | 14,0 % | 15 янв. 2024 г. |
54В плане | CVE-2023-6623Proof of concept | Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusionwpdeveloper · essential blocks · CWE-22 | Критическая9,8 | — | 50,6 % | 15 янв. 2024 г. |
22Наблюдать | CVE-2024-22207Proof of concept | Default swagger-ui configuration exposes all files in the modulesmartbear · swagger ui · CWE-1188 | Средняя5,3 | — | 2,2 % | 15 янв. 2024 г. |
26Наблюдать | CVE-2023-47459Proof of concept | An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryReview/Service/CaseManagemknovos · discovery | Средняя6,5 | — | 0,8 % | 15 янв. 2024 г. |
35Наблюдать | CVE-2023-47460Proof of concept | SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Serviknovos · discovery · CWE-89 | Высокая8,8 | — | 1,2 % | 15 янв. 2024 г. |
24Наблюдать | CVE-2023-48104Proof of concept | Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.alinto · sogo · CWE-79 | Средняя6,1 | — | 1,0 % | 15 янв. 2024 г. |
30Наблюдать | CVE-2023-51810Proof of concept | SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive informationstackideas · easydiscuss · CWE-89 | Высокая7,5 | — | 1,1 % | 15 янв. 2024 г. |
99Срочно | CVE-2023-22527Готовый эксплойт | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE atlassian · confluence data center · CWE-74 | Критическая9,8 | KEV | 99,9 % | 16 янв. 2024 г. |
40В плане | CVE-2011-10005Готовый эксплойт | EasyFTP MKD Command buffer overfloweasyftp server project · easyftp server · CWE-120 | Высокая8,8 | — | 3,5 % | 16 янв. 2024 г. |
21Наблюдать | CVE-2024-0569Эксплойта нет | Totolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosuretotolink · t8 firmware · CWE-200 | Средняя5,3 | — | 0,9 % | 16 янв. 2024 г. |
35Наблюдать | CVE-2024-0582Proof of concept | Kernel: io_uring: page use-after-free vulnerability via buffer ring mmaplinux · linux kernel · CWE-416 | Высокая7,8 | — | 12,7 % | 16 янв. 2024 г. |
58В плане | CVE-2022-1609Proof of concept | The School Management < 9.9.7 - Unauthenticated RCE via REST apiweblizar · school management · CWE-94 | Критическая9,8 | — | 64,0 % | 16 янв. 2024 г. |
30Наблюдать | CVE-2023-1405Proof of concept | Formidable Forms < 6.2 - Unauthenticated PHP Object Injectionstrategy11 · formidable forms · CWE-502 | Высокая7,5 | — | 0,7 % | 16 янв. 2024 г. |
10Наблюдать | CVE-2023-2252Proof of concept | Directorist < 7.5.4 - Admin+ LFIwpwax · directorist · CWE-22 | Низкая2,7 | — | 1,3 % | 16 янв. 2024 г. |
24Наблюдать | CVE-2023-5558Proof of concept | LearnPress < 4.2.5.5 - Reflected Cross-Site Scriptingthimpress · learnpress · CWE-79 | Средняя6,1 | — | 0,9 % | 16 янв. 2024 г. |
21Наблюдать | CVE-2023-6592Proof of concept | FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposureninjateam · fastdup · CWE-200 | Средняя5,3 | — | 0,9 % | 16 янв. 2024 г. |
32Наблюдать | CVE-2024-0235Proof of concept | EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosuremyeventon · eventon · CWE-862 | Средняя5,3 | — | 37,9 % | 16 янв. 2024 г. |
34Наблюдать | CVE-2023-22512Эксплойта нет | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server.atlassian · confluence data center · CWE-400 | Высокая7,5 | — | 14,6 % | 16 янв. 2024 г. |
61На этой неделе | CVE-2024-0200Proof of concept | Unsafe Reflection in Github Enterprise Server leading to Command Injectiongithub · enterprise server · CWE-470 | Критическая9,8 | — | 71,7 % | 16 янв. 2024 г. |
55В плане | CVE-2024-0507Proof of concept | Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Servergithub · enterprise server · CWE-20 | Высокая8,8 | — | 65,8 % | 16 янв. 2024 г. |
42В плане | CVE-2024-0517Эксплойта нет | Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crgoogle · chrome · CWE-787 | Высокая8,8 | — | 21,6 % | 16 янв. 2024 г. |
66На этой неделе | CVE-2024-0519Готовый эксплойт | Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption google · chrome · CWE-787 | Высокая8,8 | KEV | 3,8 % | 16 янв. 2024 г. |
21Наблюдать | CVE-2024-22411Proof of concept | Cross site scripting in Action messages on Avoavohq · avo · CWE-79 | Средняя5,4 | — | 0,7 % | 16 янв. 2024 г. |
24Наблюдать | CVE-2023-48858Proof of concept | A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web scripabocms · abo.cms · CWE-79 | Средняя6,1 | — | 0,5 % | 17 янв. 2024 г. |
66На этой неделе | CVE-2023-6548Готовый эксплойт | Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIcitrix · netscaler application delivery controller · CWE-94 | Высокая8,8 | KEV | 3,1 % | 17 янв. 2024 г. |
47В плане | CVE-2023-5914Proof of concept | Cross-site scripting (XSS)cloud · citrix storefront · CWE-79 | Средняя6,1 | — | 75,4 % | 17 янв. 2024 г. |
- CVE-2023-600025Наблюдать
Popup Builder < 4.2.3 - Unauthenticated Stored XSS
СредняяCVSS 6,1Proof of conceptEPSS 1 %sygnoos · popup builder1 янв. 2024 г.
- CVE-2023-642131Наблюдать
Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %w3eden · download manager1 янв. 2024 г.
- CVE-2023-5009439Наблюдать
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %yogeshojha · rengine1 янв. 2024 г.
- CVE-2024-019545В плане
spider-flow FunctionController.java FunctionService.saveFunction code injection
КритическаяCVSS 9,8Proof of conceptEPSS 19 %ssssssss · spider-flow2 янв. 2024 г.
- CVE-2024-2190740В плане
Improper Handling of Exceptional Conditions in Newtonsoft.Json
ВысокаяCVSS 7,5Proof of conceptEPSS 32 %newtonsoft · json.net3 янв. 2024 г.
- CVE-2024-2163331Наблюдать
Arbitrary file write on Decoding
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %apktool · apktool3 янв. 2024 г.
- CVE-2023-4944251В плане
Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POS
КритическаяCVSS 9,8Эксплойта нетEPSS 38 %jeecg · jeecg3 янв. 2024 г.
- CVE-2024-022338Наблюдать
Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via
ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %google · chrome3 янв. 2024 г.
- CVE-2024-2164118Наблюдать
Flarum's Logout Route allows open redirects
СредняяCVSS 4,7Proof of conceptEPSS 1 %flarum · flarum5 янв. 2024 г.
- CVE-2024-026444В плане
SourceCodester Clinic Queuing System LoginRegistration.php authorization
КритическаяCVSS 9,8Эксплойта нетEPSS 18 %oretnom23 · clinic queuing system7 янв. 2024 г.
- CVE-2024-026541В плане
SourceCodester Clinic Queuing System GET Parameter index.php file inclusion
ВысокаяCVSS 8,8Эксплойта нетEPSS 20 %oretnom23 · clinic queuing system7 янв. 2024 г.
- CVE-2023-721239Наблюдать
DeDeCMS Backend file_class.php unrestricted upload
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %dedecms · dedecms7 янв. 2024 г.
- CVE-2024-028739Наблюдать
Kashipara Food Management System itemBillPdf.php sql injection
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %kashipara · food management system7 янв. 2024 г.
- CVE-2024-030550В плане
Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure
ВысокаяCVSS 7,5Proof of conceptEPSS 66 %ncast project · ncast8 янв. 2024 г.
- CVE-2024-2164443В плане
pyLoad unauthenticated flask configuration leakage
ВысокаяCVSS 7,5Proof of conceptEPSS 42 %pyload · pyload8 янв. 2024 г.
- CVE-2024-2164528Наблюдать
pyLoad Log Injection
СредняяCVSS 5,3Proof of conceptEPSS 24 %pyload · pyload8 янв. 2024 г.
- CVE-2023-4721148В плане
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258.
ВысокаяCVSS 8,6Proof of conceptEPSS 47 %zohocorp · manageengine firewall analyzer8 янв. 2024 г.
- CVE-2024-2165067На этой неделе
XWiki Remote Code Execution vulnerability via user registration
КритическаяCVSS 9,8Proof of conceptEPSS 93 %xwiki · xwiki8 янв. 2024 г.
- CVE-2022-332828Наблюдать
Race condition in snap-confine's must_mkdir_and_open_with_perms()
ВысокаяCVSS 7,0Proof of conceptEPSS 0 %canonical · snapd8 янв. 2024 г.
- CVE-2023-650542В плане
Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure
ВысокаяCVSS 7,5Proof of conceptEPSS 39 %codexonics · prime mover8 янв. 2024 г.
- CVE-2023-675031Наблюдать
Clone < 2.4.3 - Unauthenticated Backup Download
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %backupbliss · clone8 янв. 2024 г.
- CVE-2023-5227126Наблюдать
The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via a
СредняяCVSS 6,5Proof of conceptEPSS 0 %topazevolution · antifraud8 янв. 2024 г.
- CVE-2022-4535441В плане
WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure
ВысокаяCVSS 7,5Proof of conceptEPSS 38 %wpchill · download monitor8 янв. 2024 г.
- CVE-2022-258664На этой неделе
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 10 %siemens · simatic s7-1500 tm mfp firmware8 янв. 2024 г.
- CVE-2022-258833Наблюдать
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before free
ВысокаяCVSS 7,8Proof of conceptEPSS 5 %linux · linux kernel8 янв. 2024 г.
- CVE-2022-260228Наблюдать
io_uring UAF, Unix SCM garbage collection
ВысокаяCVSS 7,0Proof of conceptEPSS 1 %linux · linux kernel8 янв. 2024 г.
- CVE-2023-5064340В плане
An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnsp
КритическаяCVSS 9,8Proof of conceptEPSS 1 %evernote · evernote8 янв. 2024 г.
- CVE-2023-4923745В плане
An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices.
КритическаяCVSS 9,8Эксплойта нетEPSS 18 %trendnet · tv-ip1314pi firmware9 янв. 2024 г.
- CVE-2022-4861858В плане
The issue was addressed with improved checks.
ВысокаяCVSS 7,0KEVГотовый эксплойтEPSS 0 %apple · ipados9 янв. 2024 г.
- CVE-2024-2065632Наблюдать
Visual Studio Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 3 %microsoft · visual studio9 янв. 2024 г.
- CVE-2024-2066627Наблюдать
BitLocker Security Feature Bypass Vulnerability
СредняяCVSS 6,6Proof of conceptEPSS 3 %microsoft · windows 10 15079 янв. 2024 г.
- CVE-2024-2067440В плане
Windows Kerberos Security Feature Bypass Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 17 %microsoft · windows 10 15079 янв. 2024 г.
- CVE-2024-2069630Наблюдать
Windows libarchive Remote Code Execution Vulnerability
ВысокаяCVSS 7,3Proof of conceptEPSS 3 %microsoft · windows 10 18099 янв. 2024 г.
- CVE-2024-2069751В плане
Windows libarchive Remote Code Execution Vulnerability
ВысокаяCVSS 7,3Эксплойта нетEPSS 72 %microsoft · windows 11 22h29 янв. 2024 г.
- CVE-2024-2069834Наблюдать
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 8 %microsoft · windows 10 18099 янв. 2024 г.
- CVE-2024-2130517Наблюдать
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
СредняяCVSS 4,4Proof of conceptEPSS 1 %microsoft · windows 10 18099 янв. 2024 г.
- CVE-2024-2130624Наблюдать
Microsoft Bluetooth Driver Spoofing Vulnerability
СредняяCVSS 5,7Proof of conceptEPSS 5 %microsoft · windows 10 21h29 янв. 2024 г.
- CVE-2024-2131034Наблюдать
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %microsoft · windows 10 18099 янв. 2024 г.
- CVE-2024-2131844В плане
Microsoft SharePoint Server Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 30 %microsoft · sharepoint server9 янв. 2024 г.
- CVE-2024-2132033Наблюдать
Windows Themes Spoofing Vulnerability
СредняяCVSS 6,5Proof of conceptEPSS 22 %microsoft · windows 10 15079 янв. 2024 г.
- CVE-2024-035261На этой неделе
Likeshop HTTP POST Request File.php userFormImage unrestricted upload
КритическаяCVSS 9,8Proof of conceptEPSS 72 %likeshop · likeshop9 янв. 2024 г.
- CVE-2023-3144657В плане
In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.
КритическаяCVSS 9,8Proof of conceptEPSS 61 %cassianetworks · xc1000 firmware9 янв. 2024 г.
- CVE-2024-036439Наблюдать
PHPGurukul Hospital Management System query-details.php sql injection
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %phpgurukul · hospital management system9 янв. 2024 г.
- CVE-2023-4947135Наблюдать
Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %barassistant · bar assistant10 янв. 2024 г.
- CVE-2023-4872825Наблюдать
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master com
СредняяCVSS 6,1Proof of conceptEPSS 2 %wwbn · avideo10 янв. 2024 г.
- CVE-2023-4878328Наблюдать
An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and
СредняяCVSS 5,4Эксплойта нетEPSS 22 %fortinet · fortiportal10 янв. 2024 г.
- CVE-2023-3148839Наблюдать
Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco
КритическаяCVSS 9,8Proof of conceptEPSS 0 %cisco · ironport email security appliance10 янв. 2024 г.
- CVE-2023-5112648В плане
Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value param
КритическаяCVSS 9,8Proof of conceptEPSS 31 %flir · flir ax8 firmware10 янв. 2024 г.
- CVE-2023-5112730Наблюдать
FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction.
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %flir · flir ax8 firmware10 янв. 2024 г.
- CVE-2023-2819713Наблюдать
An access issue was addressed with additional sandbox restrictions.
НизкаяCVSS 3,3Proof of conceptEPSS 0 %apple · macos10 янв. 2024 г.
- CVE-2023-4197462На этой неделе
A use-after-free issue was addressed with improved memory management.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 1 %apple · ipados10 янв. 2024 г.
- CVE-2023-4282922Наблюдать
The issue was addressed with additional restrictions on the observability of app states.
СредняяCVSS 5,5Proof of conceptEPSS 0 %apple · macos10 янв. 2024 г.
- CVE-2023-5112346В плане
An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the se
КритическаяCVSS 9,8Эксплойта нетEPSS 24 %dlink · dir-815 firmware10 янв. 2024 г.
- CVE-2023-5107332Наблюдать
An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/upda
ВысокаяCVSS 8,1Proof of conceptEPSS 1 %buffalo · ls210d firmware10 янв. 2024 г.
- CVE-2023-437226Наблюдать
LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
СредняяCVSS 5,4Эксплойта нетEPSS 16 %litespeedtech · litespeed cache11 янв. 2024 г.
- CVE-2023-626631Наблюдать
Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %backupbliss · backup migration11 янв. 2024 г.
- CVE-2023-656745В плане
LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
ВысокаяCVSS 7,5Proof of conceptEPSS 51 %thimpress · learnpress11 янв. 2024 г.
- CVE-2023-663442В плане
LearnPress <= 4.2.5.7 - Command Injection
КритическаяCVSS 9,8Proof of conceptEPSS 8 %thimpress · learnpress11 янв. 2024 г.
- CVE-2023-687566На этой неделе
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
КритическаяCVSS 9,8Готовый эксплойтEPSS 90 %wpexperts · post smtp11 янв. 2024 г.
- CVE-2023-2057312Наблюдать
Debug Exception Delivery in Secure Nested Paging
НизкаяCVSS 3,2Proof of conceptEPSS 0 %amd · epyc 7763 firmware11 янв. 2024 г.
- CVE-2024-2219836Наблюдать
Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)
ВысокаяCVSS 8,8Proof of conceptEPSS 4 %nginxui · nginx ui11 янв. 2024 г.
- CVE-2023-4647434Наблюдать
File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uplo
ВысокаяCVSS 7,2Proof of conceptEPSS 21 %sigb · pmb11 янв. 2024 г.
- CVE-2024-2159144В плане
Junos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code Execution
КритическаяCVSS 9,8Эксплойта нетEPSS 17 %juniper · junos11 янв. 2024 г.
- CVE-2023-4036217Наблюдать
An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023.
СредняяCVSS 4,3Proof of conceptEPSS 0 %centralsquare · click2gov building permit12 янв. 2024 г.
- CVE-2023-5091960На этой неделе
An issue was discovered on GL.iNet devices before version 4.5.0.
КритическаяCVSS 9,8Готовый эксплойтEPSS 47 %gl-inet · gl-ax1800 firmware12 янв. 2024 г.
- CVE-2023-702897Срочно
Weak Password Recovery Mechanism for Forgotten Password in GitLab
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 94 %gitlab · gitlab12 янв. 2024 г.
- CVE-2024-2188796Срочно
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an aut
КритическаяCVSS 9,1KEVГотовый эксплойтEPSS 99 %ivanti · connect secure12 янв. 2024 г.
- CVE-2023-4680592Срочно
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc
ВысокаяCVSS 8,2KEVГотовый эксплойтEPSS 99 %ivanti · connect secure12 янв. 2024 г.
- CVE-2024-02309Наблюдать
A session management issue was addressed with improved checks.
НизкаяCVSS 2,4Proof of conceptEPSS 1 %apple · magic keyboard firmware12 янв. 2024 г.
- CVE-2023-5007221Наблюдать
A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authe
СредняяCVSS 5,4Proof of conceptEPSS 0 %openkm · openkm12 янв. 2024 г.
- CVE-2024-052235Наблюдать
Allegro RomPager HTTP POST Request cross-site request forgery
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %allegrosoft · rompager14 янв. 2024 г.
- CVE-2024-052739Наблюдать
CXBSoft Url-shorting HTTP POST Request update_go.php sql injection
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %cxbsoft · url-shorting14 янв. 2024 г.
- CVE-2024-054660На этой неделе
EasyFTP LIST Command denial of service
ВысокаяCVSS 7,5Готовый эксплойтEPSS 6 %easyftp · easyftp15 янв. 2024 г.
- CVE-2023-5029047В плане
Apache Solr: Host environment variables are published via the Metrics API
СредняяCVSS 6,5Proof of conceptEPSS 68 %apache · solr15 янв. 2024 г.
- CVE-2023-662032Наблюдать
Post SMTP < 2.8.7 - Admin+ SQL Injection
ВысокаяCVSS 7,2Эксплойта нетEPSS 14 %wpexperts · post smtp15 янв. 2024 г.
- CVE-2023-662354В плане
Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
КритическаяCVSS 9,8Proof of conceptEPSS 50 %wpdeveloper · essential blocks15 янв. 2024 г.
- CVE-2024-2220722Наблюдать
Default swagger-ui configuration exposes all files in the module
СредняяCVSS 5,3Proof of conceptEPSS 2 %smartbear · swagger ui15 янв. 2024 г.
- CVE-2023-4745926Наблюдать
An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryReview/Service/CaseManagem
СредняяCVSS 6,5Proof of conceptEPSS 0 %knovos · discovery15 янв. 2024 г.
- CVE-2023-4746035Наблюдать
SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Servi
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %knovos · discovery15 янв. 2024 г.
- CVE-2023-4810424Наблюдать
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
СредняяCVSS 6,1Proof of conceptEPSS 1 %alinto · sogo15 янв. 2024 г.
- CVE-2023-5181030Наблюдать
SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %stackideas · easydiscuss15 янв. 2024 г.
- CVE-2023-2252799Срочно
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %atlassian · confluence data center16 янв. 2024 г.
- CVE-2011-1000540В плане
EasyFTP MKD Command buffer overflow
ВысокаяCVSS 8,8Готовый эксплойтEPSS 3 %easyftp server project · easyftp server16 янв. 2024 г.
- CVE-2024-056921Наблюдать
Totolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosure
СредняяCVSS 5,3Эксплойта нетEPSS 0 %totolink · t8 firmware16 янв. 2024 г.
- CVE-2024-058235Наблюдать
Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap
ВысокаяCVSS 7,8Proof of conceptEPSS 12 %linux · linux kernel16 янв. 2024 г.
- CVE-2022-160958В плане
The School Management < 9.9.7 - Unauthenticated RCE via REST api
КритическаяCVSS 9,8Proof of conceptEPSS 64 %weblizar · school management16 янв. 2024 г.
- CVE-2023-140530Наблюдать
Formidable Forms < 6.2 - Unauthenticated PHP Object Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %strategy11 · formidable forms16 янв. 2024 г.
- CVE-2023-225210Наблюдать
Directorist < 7.5.4 - Admin+ LFI
НизкаяCVSS 2,7Proof of conceptEPSS 1 %wpwax · directorist16 янв. 2024 г.
- CVE-2023-555824Наблюдать
LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting
СредняяCVSS 6,1Proof of conceptEPSS 0 %thimpress · learnpress16 янв. 2024 г.
- CVE-2023-659221Наблюдать
FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure
СредняяCVSS 5,3Proof of conceptEPSS 0 %ninjateam · fastdup16 янв. 2024 г.
- CVE-2024-023532Наблюдать
EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
СредняяCVSS 5,3Proof of conceptEPSS 37 %myeventon · eventon16 янв. 2024 г.
- CVE-2023-2251234Наблюдать
This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server.
ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %atlassian · confluence data center16 янв. 2024 г.
- CVE-2024-020061На этой неделе
Unsafe Reflection in Github Enterprise Server leading to Command Injection
КритическаяCVSS 9,8Proof of conceptEPSS 71 %github · enterprise server16 янв. 2024 г.
- CVE-2024-050755В плане
Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server
ВысокаяCVSS 8,8Proof of conceptEPSS 65 %github · enterprise server16 янв. 2024 г.
- CVE-2024-051742В плане
Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a cr
ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %google · chrome16 янв. 2024 г.
- CVE-2024-051966На этой неделе
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 3 %google · chrome16 янв. 2024 г.
- CVE-2024-2241121Наблюдать
Cross site scripting in Action messages on Avo
СредняяCVSS 5,4Proof of conceptEPSS 0 %avohq · avo16 янв. 2024 г.
- CVE-2023-4885824Наблюдать
A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web scrip
СредняяCVSS 6,1Proof of conceptEPSS 0 %abocms · abo.cms17 янв. 2024 г.
- CVE-2023-654866На этой неделе
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLI
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 3 %citrix · netscaler application delivery controller17 янв. 2024 г.
- CVE-2023-591447В плане
Cross-site scripting (XSS)
СредняяCVSS 6,1Proof of conceptEPSS 75 %cloud · citrix storefront17 янв. 2024 г.