İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2013: sömürülen ve yeni ciddi CVE kayıtları

38 kayıt · 5 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2013-3617
    40Planlayın

    The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an ext

    DüşükCVSS 3,5SilahlaştırılmışEPSS %21

    openbravo · openbravo erp2 Kas 2013

  • CVE-2013-3631
    40Planlayın

    NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advance

    OrtaCVSS 6,0SilahlaştırılmışEPSS %13

    nas4free · nas4free2 Kas 2013

  • CVE-2013-6023
    34İzleyin

    Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbi

    YüksekCVSS 7,8Kavram kanıtıEPSS %10

    tvt · dvr2 Kas 2013

  • CVE-2013-4835
    51Planlayın

    The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute a

    YüksekCVSS 7,5SilahlaştırılmışEPSS %71

    hp · sitescope4 Kas 2013

  • CVE-2013-4837
    59Planlayın

    Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unkn

    KritikCVSS 10,0SilahlaştırılmışEPSS %62

    hp · loadrunner4 Kas 2013

  • CVE-2013-4838
    43Planlayın

    Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unkn

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · loadrunner4 Kas 2013

  • CVE-2013-6618
    39İzleyin

    jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.

    KritikCVSS 9,0Kavram kanıtıEPSS %10

    juniper · junos5 Kas 2013

  • CVE-2013-3906
    86Hemen

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %84

    microsoft · excel viewer6 Kas 2013

  • CVE-2013-3986
    40Planlayın

    IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted

    OrtaCVSS 4,3SilahlaştırılmışEPSS %9

    ibm · lotus sametime8 Kas 2013

  • CVE-2013-3918
    87Hemen

    The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %73

    microsoft · windows 712 Kas 2013

  • CVE-2013-0082
    43Planlayın

    Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka

    KritikCVSS 9,3İstismar yokEPSS %18

    microsoft · office12 Kas 2013

  • CVE-2013-1324
    46Planlayın

    Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute a

    KritikCVSS 9,3İstismar yokEPSS %31

    microsoft · office12 Kas 2013

  • CVE-2013-1325
    46Planlayın

    Heap-based buffer overflow in Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPer

    KritikCVSS 9,3İstismar yokEPSS %31

    microsoft · office12 Kas 2013

  • CVE-2013-3869
    25İzleyin

    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,

    OrtaCVSS 5,0İstismar yokEPSS %17

    microsoft · windows 712 Kas 2013

  • CVE-2013-3905
    23İzleyin

    Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which al

    OrtaCVSS 5,0İstismar yokEPSS %11

    microsoft · outlook12 Kas 2013

  • CVE-2013-3908
    27İzleyin

    Microsoft Internet Explorer 6 through 10 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive informa

    OrtaCVSS 4,3İstismar yokEPSS %33

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3909
    22İzleyin

    Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characte

    OrtaCVSS 4,3İstismar yokEPSS %15

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3910
    43Planlayın

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3911
    43Planlayın

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3912
    43Planlayın

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3914
    43Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3915
    43Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3916
    42Planlayın

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3917
    42Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · internet explorer12 Kas 2013

  • CVE-2013-3940
    47Planlayın

    Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Win

    KritikCVSS 9,3İstismar yokEPSS %34

    microsoft · windows 712 Kas 2013

  • CVE-2013-5330
    43Planlayın

    Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, A

    KritikCVSS 10,0İstismar yokEPSS %11

    adobe · flash player12 Kas 2013

  • CVE-2013-4557
    40Planlayın

    The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers

    YüksekCVSS 7,5SilahlaştırılmışEPSS %25

    spip · spip17 Kas 2013

  • CVE-2013-6801
    32İzleyin

    Microsoft Word 2003 SP2 and SP3 on Windows XP SP3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed .do

    YüksekCVSS 7,1İstismar yokEPSS %14

    microsoft · word18 Kas 2013

  • CVE-2013-5223
    66Bu hafta

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev.

    OrtaCVSS 5,4KEVSilahlaştırılmışEPSS %50

    dlink · dsl-2760u firmware19 Kas 2013

  • CVE-2013-4579
    20İzleyin

    The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking

    OrtaCVSS 4,3Kavram kanıtıEPSS %10

    linux · linux kernel20 Kas 2013

  • CVE-2013-6282
    77Bu hafta

    The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain add

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %39

    linux · linux kernel20 Kas 2013

  • CVE-2013-4559
    33İzleyin

    lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd

    YüksekCVSS 7,6İstismar yokEPSS %10

    lighttpd · lighttpd20 Kas 2013

  • CVE-2013-6829
    54Planlayın

    admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pingh

    YüksekCVSS 7,5SilahlaştırılmışEPSS %79

    pineapp · mail-secure20 Kas 2013

  • CVE-2013-4474
    23İzleyin

    Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a

    OrtaCVSS 5,0Kavram kanıtıEPSS %10

    canonical · ubuntu linux23 Kas 2013

  • CVE-2013-4547
    50Planlayın

    nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character i

    YüksekCVSS 7,5Kavram kanıtıEPSS %67

    f5 · nginx23 Kas 2013

  • CVE-2013-4164
    40Planlayın

    Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 4

    OrtaCVSS 6,8SilahlaştırılmışEPSS %34

    ruby-lang · ruby23 Kas 2013

  • CVE-2013-5065
    71Bu hafta

    NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted applic

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %34

    microsoft · windows 2003 server27 Kas 2013

  • CVE-2013-5912
    49Planlayın

    VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via

    KritikCVSS 10,0Kavram kanıtıEPSS %30

    thomsonreuters · velocity analytics vhayu analytic server28 Kas 2013