İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2012: sömürülen ve yeni ciddi CVE kayıtları

39 kayıt · 1 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2011-4642
    40Planlayın

    mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allo

    OrtaCVSS 4,6SilahlaştırılmışEPSS %28

    splunk · splunk3 Oca 2012

  • CVE-2011-5052
    40Planlayın

    Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a downlo

    OrtaCVSS 6,8SilahlaştırılmışEPSS %29

    cocsoft · stream down4 Oca 2012

  • CVE-2011-4858
    44Planlayın

    Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the abili

    OrtaCVSS 5,0SilahlaştırılmışEPSS %79

    apache · tomcat5 Oca 2012

  • CVE-2011-4108
    22İzleyin

    The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it

    OrtaCVSS 4,3İstismar yokEPSS %16

    openssl · openssl5 Oca 2012

  • CVE-2011-4109
    42Planlayın

    Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspe

    KritikCVSS 9,3İstismar yokEPSS %16

    openssl · openssl5 Oca 2012

  • CVE-2011-4576
    25İzleyin

    The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padd

    OrtaCVSS 5,0İstismar yokEPSS %15

    openssl · openssl5 Oca 2012

  • CVE-2011-4619
    25İzleyin

    The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restart

    OrtaCVSS 5,0İstismar yokEPSS %17

    openssl · openssl5 Oca 2012

  • CVE-2012-0391
    92Hemen

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception ha

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %75

    apache · struts8 Oca 2012

  • CVE-2012-0392
    56Planlayın

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to

    OrtaCVSS 6,8Kavram kanıtıEPSS %97

    apache · struts8 Oca 2012

  • CVE-2012-0393
    36İzleyin

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attac

    OrtaCVSS 6,4Kavram kanıtıEPSS %36

    apache · struts8 Oca 2012

  • CVE-2012-0394
    49Planlayın

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrar

    OrtaCVSS 6,8SilahlaştırılmışEPSS %72

    apache · struts8 Oca 2012

  • CVE-2011-5057
    28İzleyin

    Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the sessio

    OrtaCVSS 5,0Kavram kanıtıEPSS %27

    apache · struts8 Oca 2012

  • CVE-2011-4372
    43Planlayın

    Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a de

    KritikCVSS 9,8İstismar yokEPSS %12

    adobe · acrobat10 Oca 2012

  • CVE-2011-4373
    48Planlayın

    Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a de

    KritikCVSS 9,8İstismar yokEPSS %30

    adobe · acrobat10 Oca 2012

  • CVE-2012-0003
    60Bu hafta

    Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Serv

    YüksekCVSS 8,1SilahlaştırılmışEPSS %69

    microsoft · windows 710 Oca 2012

  • CVE-2012-0004
    44Planlayın

    Unspecified vulnerability in DirectShow in DirectX in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · windows 710 Oca 2012

  • CVE-2012-0007
    23İzleyin

    The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascadi

    OrtaCVSS 4,3Kavram kanıtıEPSS %18

    microsoft · anti-cross site scripting library10 Oca 2012

  • CVE-2012-0009
    42Planlayın

    Untrusted search path vulnerability in the Windows Object Packager configuration in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 all

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · windows server 200310 Oca 2012

  • CVE-2012-0013
    59Planlayın

    Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windo

    KritikCVSS 9,3SilahlaştırılmışEPSS %73

    microsoft · windows 710 Oca 2012

  • CVE-2011-4786
    49Planlayın

    A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitra

    KritikCVSS 9,3SilahlaştırılmışEPSS %39

    hp · easy printer care software12 Oca 2012

  • CVE-2011-4789
    59Planlayın

    Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbi

    KritikCVSS 10,0SilahlaştırılmışEPSS %64

    hp · diagnostics13 Oca 2012

  • CVE-2011-3597
    34İzleyin

    Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    gisle aas · digest13 Oca 2012

  • CVE-2012-0266
    50Planlayın

    Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a l

    KritikCVSS 9,3SilahlaştırılmışEPSS %42

    ntrglobal · ntr activex control14 Oca 2012

  • CVE-2012-0267
    49Planlayın

    The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule para

    KritikCVSS 9,3SilahlaştırılmışEPSS %38

    ntrglobal · ntr activex control14 Oca 2012

  • CVE-2010-5082
    41Planlayın

    Untrusted search path vulnerability in colorcpl.exe 6.0.6000.16386 in the Color Control Panel in Microsoft Windows Server 2008 SP2, R2, and

    KritikCVSS 9,3İstismar yokEPSS %14

    microsoft · windows server 200817 Oca 2012

  • CVE-2011-4153
    24İzleyin

    PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of servi

    OrtaCVSS 5,0Kavram kanıtıEPSS %11

    php · php18 Oca 2012

  • CVE-2012-0781
    23İzleyin

    The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application

    OrtaCVSS 5,0Kavram kanıtıEPSS %10

    php · php18 Oca 2012

  • CVE-2012-0022
    23İzleyin

    Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allo

    OrtaCVSS 5,0İstismar yokEPSS %10

    apache · tomcat19 Oca 2012

  • CVE-2011-4135
    49Planlayın

    Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote a

    KritikCVSS 10,0SilahlaştırılmışEPSS %30

    flexerasoftware · flexnet publisher19 Oca 2012

  • CVE-2012-0050
    24İzleyin

    OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) vi

    OrtaCVSS 5,0İstismar yokEPSS %13

    openssl · openssl19 Oca 2012

  • CVE-2012-0896
    27İzleyin

    Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read

    OrtaCVSS 5,0Kavram kanıtıEPSS %22

    wordpress · wordpress20 Oca 2012

  • CVE-2012-0897
    43Planlayın

    Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a

    OrtaCVSS 6,8SilahlaştırılmışEPSS %52

    irfanview · irfanview20 Oca 2012

  • CVE-2011-3478
    52Planlayın

    The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7

    KritikCVSS 10,0Kavram kanıtıEPSS %39

    symantec · pcanywhere25 Oca 2012

  • CVE-2011-3874
    40Planlayın

    Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to e

    KritikCVSS 9,3İstismar yokEPSS %11

    google · android27 Oca 2012

  • CVE-2012-0056
    30İzleyin

    The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<p

    OrtaCVSS 6,9Kavram kanıtıEPSS %10

    linux · linux kernel27 Oca 2012

  • CVE-2012-0021
    19İzleyin

    The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MP

    DüşükCVSS 2,6İstismar yokEPSS %30

    apache · http server28 Oca 2012

  • CVE-2012-0053
    42Planlayın

    protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (

    OrtaCVSS 4,3Kavram kanıtıEPSS %82

    apache · http server28 Oca 2012

  • CVE-2011-3829
    40Planlayın

    ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the fi

    OrtaCVSS 4,0SilahlaştırılmışEPSS %17

    sitracker · support incident tracker29 Oca 2012

  • CVE-2011-3833
    40Planlayın

    Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users

    OrtaCVSS 6,0SilahlaştırılmışEPSS %19

    sitracker · support incident tracker29 Oca 2012