İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2013: sömürülen ve yeni ciddi CVE kayıtları

52 kayıt · 2 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2012-5627
    19İzleyin

    Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executio

    OrtaCVSS 4,0Kavram kanıtıEPSS %11

    oracle · mysql1 Eki 2013

  • CVE-2013-3690
    31İzleyin

    Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040

    OrtaCVSS 6,8Kavram kanıtıEPSS %12

    brickcom · 100ap device firmware1 Eki 2013

  • CVE-2013-1892
    40Planlayın

    MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows r

    OrtaCVSS 6,0SilahlaştırılmışEPSS %44

    mongodb · mongodb1 Eki 2013

  • CVE-2013-3969
    29İzleyin

    The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (u

    OrtaCVSS 6,5Kavram kanıtıEPSS %10

    mongodb · mongodb1 Eki 2013

  • CVE-2013-5979
    25İzleyin

    Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary

    OrtaCVSS 5,0Kavram kanıtıEPSS %18

    xibosignage · xibo2 Eki 2013

  • CVE-2013-3248
    43Planlayın

    Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in t

    KritikCVSS 9,3SilahlaştırılmışEPSS %18

    corel · pdf fusion3 Eki 2013

  • CVE-2013-4788
    23İzleyin

    The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initial

    OrtaCVSS 5,1Kavram kanıtıEPSS %11

    gnu · glibc4 Eki 2013

  • CVE-2013-3128
    52Planlayın

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,

    KritikCVSS 9,3İstismar yokEPSS %50

    microsoft · windows 79 Eki 2013

  • CVE-2013-3195
    52Planlayın

    The DSA_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2, Windows Server 2003 SP2, Wind

    KritikCVSS 10,0İstismar yokEPSS %38

    microsoft · windows 79 Eki 2013

  • CVE-2013-3860
    40Planlayın

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, whi

    YüksekCVSS 7,8İstismar yokEPSS %30

    microsoft · .net framework9 Eki 2013

  • CVE-2013-3861
    56Planlayın

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or

    YüksekCVSS 7,8İstismar yokEPSS %82

    microsoft · .net framework9 Eki 2013

  • CVE-2013-3871
    43Planlayın

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %21

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3872
    43Planlayın

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3873
    43Planlayın

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3874
    43Planlayın

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3875
    43Planlayın

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3880
    18İzleyin

    The App Container feature in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to

    DüşükCVSS 3,5İstismar yokEPSS %12

    microsoft · windows 89 Eki 2013

  • CVE-2013-3881
    40Planlayın

    win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a

    YüksekCVSS 7,2SilahlaştırılmışEPSS %14

    microsoft · windows 79 Eki 2013

  • CVE-2013-3882
    43Planlayın

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3885
    43Planlayın

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3886
    43Planlayın

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-3889
    45Planlayın

    Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Ex

    KritikCVSS 9,3İstismar yokEPSS %27

    microsoft · excel9 Eki 2013

  • CVE-2013-3890
    43Planlayın

    Microsoft Excel 2007 SP3, Excel Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Off

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · excel9 Eki 2013

  • CVE-2013-3891
    43Planlayın

    Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerabilit

    KritikCVSS 9,3İstismar yokEPSS %18

    microsoft · word9 Eki 2013

  • CVE-2013-3892
    43Planlayın

    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, ak

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · office compatibility pack9 Eki 2013

  • CVE-2013-3894
    45Planlayın

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,

    YüksekCVSS 8,1İstismar yokEPSS %43

    microsoft · windows 79 Eki 2013

  • CVE-2013-3895
    36İzleyin

    Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, ak

    OrtaCVSS 6,8İstismar yokEPSS %29

    microsoft · office web apps9 Eki 2013

  • CVE-2013-3896
    72Bu hafta

    Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote at

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %67

    microsoft · silverlight9 Eki 2013

  • CVE-2013-3897
    88Hemen

    Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %77

    microsoft · internet explorer9 Eki 2013

  • CVE-2013-5576
    41Planlayın

    administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote

    OrtaCVSS 6,8SilahlaştırılmışEPSS %48

    joomla · joomla\!9 Eki 2013

  • CVE-2013-5967
    40Planlayın

    Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attack

    YüksekCVSS 7,5SilahlaştırılmışEPSS %19

    alienvault · open source security information management9 Eki 2013

  • CVE-2012-4412
    35İzleyin

    Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to caus

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    gnu · glibc9 Eki 2013

  • CVE-2013-5528
    23İzleyin

    Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authentic

    OrtaCVSS 4,0Kavram kanıtıEPSS %23

    cisco · unified communications manager10 Eki 2013

  • CVE-2013-2578
    62Bu hafta

    cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware L

    KritikCVSS 10,0SilahlaştırılmışEPSS %73

    tp-link · tl-sc313011 Eki 2013

  • CVE-2013-3686
    48Planlayın

    cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password vi

    KritikCVSS 10,0Kavram kanıtıEPSS %27

    ovislink · airlive wl2600cam11 Eki 2013

  • CVE-2013-4822
    59Planlayın

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIM

    KritikCVSS 10,0SilahlaştırılmışEPSS %62

    hp · imc branch intelligent management system software module13 Eki 2013

  • CVE-2013-4823
    40Planlayın

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIM

    OrtaCVSS 5,0SilahlaştırılmışEPSS %37

    hp · intelligent management center13 Eki 2013

  • CVE-2013-4824
    40Planlayın

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote at

    YüksekCVSS 7,5SilahlaştırılmışEPSS %23

    hp · imc service operation management software module13 Eki 2013

  • CVE-2013-4826
    40Planlayın

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote at

    OrtaCVSS 5,0SilahlaştırılmışEPSS %31

    hp · imc service operation management software module13 Eki 2013

  • CVE-2013-3827
    30İzleyin

    Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDevelope

    OrtaCVSS 5,0Kavram kanıtıEPSS %32

    oracle · fusion middleware16 Eki 2013

  • CVE-2013-5842
    45Planlayın

    Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u4

    KritikCVSS 10,0Kavram kanıtıEPSS %17

    oracle · jdk16 Eki 2013

  • CVE-2013-4365
    34İzleyin

    Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HT

    YüksekCVSS 7,5İstismar yokEPSS %13

    apache · mod fcgid17 Eki 2013

  • CVE-2013-6021
    41Planlayın

    Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid

    KritikCVSS 9,3Kavram kanıtıEPSS %11

    watchguard · fireware19 Eki 2013

  • CVE-2013-6129
    46Planlayın

    The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata

    YüksekCVSS 7,5SilahlaştırılmışEPSS %51

    vbulletin · vbulletin19 Eki 2013

  • CVE-2013-4450
    40Planlayın

    The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CP

    OrtaCVSS 5,0SilahlaştırılmışEPSS %37

    nodejs · nodejs21 Eki 2013

  • CVE-2013-4295
    24İzleyin

    The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing a

    OrtaCVSS 5,0Kavram kanıtıEPSS %11

    apache · shindig23 Eki 2013

  • CVE-2013-5135
    33İzleyin

    Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple Remote Desktop before 3.5.4 allows remote attac

    YüksekCVSS 7,5İstismar yokEPSS %10

    apple · apple remote desktop23 Eki 2013

  • CVE-2013-6127
    27İzleyin

    The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly re

    OrtaCVSS 5,8Kavram kanıtıEPSS %13

    wellintech · kingview25 Eki 2013

  • CVE-2011-4106
    34İzleyin

    TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload a

    OrtaCVSS 6,8Kavram kanıtıEPSS %23

    binarymoon · timthumb26 Eki 2013

  • CVE-2013-2186
    34İzleyin

    The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red H

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    redhat · jboss enterprise brms platform28 Eki 2013

  • CVE-2012-6303
    30İzleyin

    Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4,

    OrtaCVSS 6,8Kavram kanıtıEPSS %10

    kth · snack sound toolkit28 Eki 2013

  • CVE-2013-3630
    40Planlayın

    Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then tr

    OrtaCVSS 4,6SilahlaştırılmışEPSS %41

    moodle · moodle31 Eki 2013