İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2012: sömürülen ve yeni ciddi CVE kayıtları

33 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2012-5223
    42Planlayın

    The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers

    YüksekCVSS 7,5SilahlaştırılmışEPSS %40

    crawlability · vbseo1 Eki 2012

  • CVE-2012-1153
    40Planlayın

    Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute

    OrtaCVSS 6,8SilahlaştırılmışEPSS %32

    apprain · apprain6 Eki 2012

  • CVE-2012-5306
    41Planlayın

    Stack-based buffer overflow in the SelectDirectory method in DcsCliCtrl.dll in Camera Stream Client ActiveX Control, as used in D-Link DCS-5

    KritikCVSS 9,3Kavram kanıtıEPSS %12

    dlink · camera stream client activex control6 Eki 2012

  • CVE-2010-5278
    23İzleyin

    Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when ma

    OrtaCVSS 4,3Kavram kanıtıEPSS %18

    modx · modx revolution7 Eki 2012

  • CVE-2012-1125
    30İzleyin

    Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows r

    OrtaCVSS 6,8Kavram kanıtıEPSS %11

    wordpress · wordpress8 Eki 2012

  • CVE-2011-4342
    33İzleyin

    PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to ex

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    backwpup · backwpup8 Eki 2012

  • CVE-2011-4929
    44Planlayın

    Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitr

    YüksekCVSS 7,5SilahlaştırılmışEPSS %46

    redmine · redmine8 Eki 2012

  • CVE-2012-5321
    27İzleyin

    tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishi

    OrtaCVSS 5,8Kavram kanıtıEPSS %13

    tiki · tikiwiki cms\/groupware8 Eki 2012

  • CVE-2012-0182
    57Planlayın

    Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remote attackers to execu

    KritikCVSS 9,3İstismar yokEPSS %68

    microsoft · word9 Eki 2012

  • CVE-2012-2520
    27İzleyin

    Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Atten

    OrtaCVSS 4,3İstismar yokEPSS %34

    microsoft · groove server9 Eki 2012

  • CVE-2012-2528
    44Planlayın

    Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3;

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · word automation services9 Eki 2012

  • CVE-2012-2550
    44Planlayın

    Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted Word

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · works9 Eki 2012

  • CVE-2012-2551
    28İzleyin

    The server in Kerberos in Microsoft Windows Server 2008 R2 and R2 SP1, and Windows 7 Gold and SP1, allows remote attackers to cause a denial

    OrtaCVSS 5,0İstismar yokEPSS %27

    microsoft · windows 79 Eki 2012

  • CVE-2012-2552
    22İzleyin

    Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server

    OrtaCVSS 4,3İstismar yokEPSS %16

    microsoft · sql server9 Eki 2012

  • CVE-2012-4399
    34İzleyin

    The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing e

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    cakefoundation · cakephp9 Eki 2012

  • CVE-2012-3993
    50Planlayın

    The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thun

    KritikCVSS 9,3SilahlaştırılmışEPSS %42

    mozilla · firefox10 Eki 2012

  • CVE-2012-4186
    41Planlayın

    Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thu

    KritikCVSS 9,3İstismar yokEPSS %14

    mozilla · firefox10 Eki 2012

  • CVE-2012-4188
    41Planlayın

    Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16

    KritikCVSS 9,3İstismar yokEPSS %14

    mozilla · firefox10 Eki 2012

  • CVE-2012-5166
    41Planlayın

    ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attac

    YüksekCVSS 7,8İstismar yokEPSS %34

    isc · bind10 Eki 2012

  • CVE-2012-1533
    61Bu hafta

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earl

    KritikCVSS 10,0SilahlaştırılmışEPSS %69

    oracle · jdk16 Eki 2012

  • CVE-2012-5067
    39İzleyin

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers t

    OrtaCVSS 5,0Kavram kanıtıEPSS %63

    oracle · jdk16 Eki 2012

  • CVE-2012-5076
    96Hemen

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers t

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91

    oracle · jre16 Eki 2012

  • CVE-2012-5081
    40Planlayın

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier,

    OrtaCVSS 5,0SilahlaştırılmışEPSS %45

    oracle · jdk16 Eki 2012

  • CVE-2012-5088
    64Bu hafta

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers t

    KritikCVSS 10,0SilahlaştırılmışEPSS %78

    oracle · jre16 Eki 2012

  • CVE-2012-0518
    60Bu hafta

    Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote att

    OrtaCVSS 4,7KEVSilahlaştırılmışEPSS %4

    oracle · fusion middleware16 Eki 2012

  • CVE-2012-3152
    96Hemen

    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remo

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %98

    oracle · fusion middleware16 Eki 2012

  • CVE-2012-3153
    54Planlayın

    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remo

    OrtaCVSS 6,4SilahlaştırılmışEPSS %98

    oracle · fusion middleware16 Eki 2012

  • CVE-2012-4933
    44Planlayın

    The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard

    YüksekCVSS 7,8SilahlaştırılmışEPSS %44

    novell · zenworks asset management20 Eki 2012

  • CVE-2012-3001
    42Planlayın

    Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command

    YüksekCVSS 8,5SilahlaştırılmışEPSS %27

    mutiny · standard22 Eki 2012

  • CVE-2012-5672
    21İzleyin

    Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of servi

    OrtaCVSS 4,3Kavram kanıtıEPSS %12

    microsoft · excel25 Eki 2012

  • CVE-2011-5227
    63Bu hafta

    Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote

    KritikCVSS 10,0SilahlaştırılmışEPSS %76

    enterasys · netsight25 Eki 2012

  • CVE-2012-5692
    48Planlayın

    Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impac

    KritikCVSS 10,0SilahlaştırılmışEPSS %26

    invisioncommunity · invision power board31 Eki 2012

  • CVE-2012-4940
    51Planlayın

    Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or de

    OrtaCVSS 6,4SilahlaştırılmışEPSS %85

    gecad · axigen free mail server31 Eki 2012