İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2013: sömürülen ve yeni ciddi CVE kayıtları

58 kayıt · 6 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2012-6081
    40Planlayın

    Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) act

    OrtaCVSS 6,0SilahlaştırılmışEPSS %35

    moinmo · moinmoin2 Oca 2013

  • CVE-2012-6495
    30İzleyin

    Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions

    OrtaCVSS 6,0Kavram kanıtıEPSS %18

    moinmo · moinmoin2 Oca 2013

  • CVE-2012-6329
    49Planlayın

    The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and f

    YüksekCVSS 7,5SilahlaştırılmışEPSS %63

    perl · perl4 Oca 2013

  • CVE-2012-6330
    31İzleyin

    The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to c

    OrtaCVSS 5,0Kavram kanıtıEPSS %35

    twiki · twiki4 Oca 2013

  • CVE-2013-0625
    97Hemen

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    adobe · coldfusion8 Oca 2013

  • CVE-2013-0629
    80Hemen

    Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspeci

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %65

    adobe · coldfusion8 Oca 2013

  • CVE-2013-0631
    80Hemen

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %66

    adobe · coldfusion8 Oca 2013

  • CVE-2013-0001
    21İzleyin

    The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly init

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · .net framework9 Oca 2013

  • CVE-2013-0002
    45Planlayın

    Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4,

    KritikCVSS 9,3İstismar yokEPSS %25

    microsoft · .net framework9 Oca 2013

  • CVE-2013-0003
    44Planlayın

    Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1,

    KritikCVSS 9,3İstismar yokEPSS %23

    microsoft · .net framework9 Oca 2013

  • CVE-2013-0004
    43Planlayın

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in

    KritikCVSS 9,3İstismar yokEPSS %21

    microsoft · .net framework9 Oca 2013

  • CVE-2013-0005
    41Planlayın

    The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and th

    YüksekCVSS 7,8İstismar yokEPSS %32

    microsoft · .net framework9 Oca 2013

  • CVE-2013-0006
    43Planlayın

    Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbi

    YüksekCVSS 8,8İstismar yokEPSS %28

    microsoft · xml core services9 Oca 2013

  • CVE-2013-0007
    46Planlayın

    Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbi

    KritikCVSS 9,3Kavram kanıtıEPSS %31

    microsoft · xml core services9 Oca 2013

  • CVE-2013-0008
    40Planlayın

    win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windo

    YüksekCVSS 7,2SilahlaştırılmışEPSS %17

    microsoft · windows vista9 Oca 2013

  • CVE-2013-0009
    21İzleyin

    Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arb

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · system center operations manager9 Oca 2013

  • CVE-2013-0010
    22İzleyin

    Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arb

    OrtaCVSS 4,3İstismar yokEPSS %16

    microsoft · system center operations manager9 Oca 2013

  • CVE-2013-0011
    49Planlayın

    The Print Spooler in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary cod

    KritikCVSS 10,0İstismar yokEPSS %30

    microsoft · windows 79 Oca 2013

  • CVE-2013-0613
    43Planlayın

    Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitr

    KritikCVSS 10,0İstismar yokEPSS %10

    adobe · acrobat10 Oca 2013

  • CVE-2013-0422
    98Hemen

    Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBean

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    oracle · jdk10 Oca 2013

  • CVE-2011-5252
    27İzleyin

    Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x befo

    OrtaCVSS 5,8Kavram kanıtıEPSS %11

    orchardproject · orchard12 Oca 2013

  • CVE-2012-6499
    26İzleyin

    Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to

    OrtaCVSS 5,8Kavram kanıtıEPSS %10

    wordpress · wordpress12 Oca 2013

  • CVE-2013-0753
    52Planlayın

    Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox

    KritikCVSS 9,3SilahlaştırılmışEPSS %51

    mozilla · firefox13 Oca 2013

  • CVE-2013-0757
    55Planlayın

    The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Th

    KritikCVSS 9,3SilahlaştırılmışEPSS %60

    mozilla · firefox13 Oca 2013

  • CVE-2013-0758
    59Planlayın

    Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before

    KritikCVSS 9,3SilahlaştırılmışEPSS %73

    mozilla · firefox13 Oca 2013

  • CVE-2013-0156
    60Bu hafta

    active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1

    YüksekCVSS 7,5SilahlaştırılmışEPSS %99

    rubyonrails · rails13 Oca 2013

  • CVE-2013-0632
    97Hemen

    administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitr

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    adobe · coldfusion16 Oca 2013

  • CVE-2012-5875
    23İzleyin

    Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1) crafted Connection

    OrtaCVSS 5,0Kavram kanıtıEPSS %10

    fireflymediaserver · firefly media server18 Oca 2013

  • CVE-2013-0657
    46Planlayın

    Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execut

    KritikCVSS 10,0Kavram kanıtıEPSS %21

    schneider-electric · interactive graphical scada system21 Oca 2013

  • CVE-2013-0928
    47Planlayın

    The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execut

    KritikCVSS 9,3SilahlaştırılmışEPSS %34

    emc · alphastor21 Oca 2013

  • CVE-2012-6502
    13İzleyin

    Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain

    DüşükCVSS 2,6İstismar yokEPSS %10

    microsoft · internet explorer22 Oca 2013

  • CVE-2012-6096
    50Planlayın

    Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2,

    YüksekCVSS 7,5SilahlaştırılmışEPSS %66

    nagios · nagios22 Oca 2013

  • CVE-2013-0209
    44Planlayın

    lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migr

    YüksekCVSS 7,5SilahlaştırılmışEPSS %45

    sixapart · movable type22 Oca 2013

  • CVE-2011-4618
    20İzleyin

    Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attacke

    OrtaCVSS 4,3Kavram kanıtıEPSS %10

    wordpress · wordpress23 Oca 2013

  • CVE-2012-6435
    40Planlayın

    Rockwell Automation ControlLogix PLC Improper Access Control

    YüksekCVSS 7,5İstismar yokEPSS %33

    rockwellautomation · controllogix controllers24 Oca 2013

  • CVE-2012-6436
    38İzleyin

    Rockwell Automation ControlLogix PLC Improper Input Validation

    YüksekCVSS 7,5İstismar yokEPSS %27

    rockwellautomation · controllogix controllers24 Oca 2013

  • CVE-2012-6438
    38İzleyin

    Rockwell Automation ControlLogix PLC Improper Input Validation

    YüksekCVSS 7,5İstismar yokEPSS %27

    rockwellautomation · controllogix controllers24 Oca 2013

  • CVE-2012-6439
    41Planlayın

    Rockwell Automation ControlLogix PLC Improper Access Control

    YüksekCVSS 8,5İstismar yokEPSS %23

    rockwellautomation · controllogix controllers24 Oca 2013

  • CVE-2012-6441
    37İzleyin

    Rockwell Automation ControlLogix PLC Information Exposure

    OrtaCVSS 5,0İstismar yokEPSS %57

    rockwellautomation · controllogix controllers24 Oca 2013

  • CVE-2012-6442
    41Planlayın

    Rockwell Automation ControlLogix PLC Improper Access Control

    YüksekCVSS 7,5İstismar yokEPSS %35

    rockwellautomation · ethernet\/ip firmware24 Oca 2013

  • CVE-2012-5689
    32İzleyin

    ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks

    YüksekCVSS 7,1İstismar yokEPSS %12

    isc · bind25 Oca 2013

  • CVE-2012-3278
    43Planlayın

    Stack-based buffer overflow in magentservice.exe in HP Diagnostics Server 8.x through 8.07 and 9.x through 9.21 allows remote attackers to e

    KritikCVSS 10,0İstismar yokEPSS %11

    hp · diagnostics server25 Oca 2013

  • CVE-2012-4914
    46Planlayın

    Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a c

    KritikCVSS 9,3SilahlaştırılmışEPSS %28

    coolpdf · coolpdf26 Oca 2013

  • CVE-2013-0653
    40Planlayın

    Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICI

    OrtaCVSS 4,3SilahlaştırılmışEPSS %19

    ge · intelligent platforms proficy hmi\/scada cimplicity27 Oca 2013

  • CVE-2013-1451
    22İzleyin

    Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure

    OrtaCVSS 4,0Kavram kanıtıEPSS %20

    microsoft · internet explorer29 Oca 2013

  • CVE-2013-0333
    59Planlayın

    lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to

    YüksekCVSS 7,5SilahlaştırılmışEPSS %95

    rubyonrails · rails30 Oca 2013

  • CVE-2012-6530
    42Planlayın

    Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folde

    YüksekCVSS 7,1SilahlaştırılmışEPSS %46

    sysax · multi server31 Oca 2013

  • CVE-2013-0431
    71Bu hafta

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-

    DüşükCVSS 3,7KEVSilahlaştırılmışEPSS %90

    oracle · jre31 Oca 2013

  • CVE-2012-5958
    65Bu hafta

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0SilahlaştırılmışEPSS %83

    libupnp project · libupnp31 Oca 2013

  • CVE-2012-5959
    63Bu hafta

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0SilahlaştırılmışEPSS %75

    portable sdk for upnp project · portable sdk for upnp31 Oca 2013

  • CVE-2012-5960
    50Planlayın

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0Kavram kanıtıEPSS %32

    portable sdk for upnp project · portable sdk for upnp31 Oca 2013

  • CVE-2012-5961
    51Planlayın

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0Kavram kanıtıEPSS %36

    libupnp project · libupnp31 Oca 2013

  • CVE-2012-5962
    51Planlayın

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0Kavram kanıtıEPSS %36

    portable sdk for upnp project · portable sdk for upnp31 Oca 2013

  • CVE-2012-5963
    51Planlayın

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0Kavram kanıtıEPSS %36

    portable sdk for upnp project · portable sdk for upnp31 Oca 2013

  • CVE-2012-5964
    51Planlayın

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0Kavram kanıtıEPSS %36

    portable sdk for upnp project · portable sdk for upnp31 Oca 2013

  • CVE-2012-5965
    51Planlayın

    Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device

    KritikCVSS 10,0Kavram kanıtıEPSS %36

    portable sdk for upnp project · portable sdk for upnp31 Oca 2013

  • CVE-2013-0229
    54Planlayın

    The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial

    YüksekCVSS 7,8SilahlaştırılmışEPSS %76

    miniupnp project · miniupnpd31 Oca 2013

  • CVE-2013-0230
    61Bu hafta

    Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows

    KritikCVSS 10,0SilahlaştırılmışEPSS %69

    miniupnp project · miniupnpd31 Oca 2013