İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2014: sömürülen ve yeni ciddi CVE kayıtları

47 kayıt · 1 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2013-6450
    28İzleyin

    The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for

    OrtaCVSS 5,8İstismar yokEPSS %15

    openssl · openssl1 Oca 2014

  • CVE-2013-5211
    49Planlayın

    The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplificat

    OrtaCVSS 5,0SilahlaştırılmışEPSS %97

    ntp · ntp2 Oca 2014

  • CVE-2013-7240
    26İzleyin

    Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read ar

    OrtaCVSS 5,0Kavram kanıtıEPSS %19

    wordpress · wordpress3 Oca 2014

  • CVE-2013-7260
    50Planlayın

    Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow r

    YüksekCVSS 7,5SilahlaştırılmışEPSS %66

    realnetworks · realplayer3 Oca 2014

  • CVE-2013-2344
    43Planlayın

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · storage data protector4 Oca 2014

  • CVE-2013-2345
    43Planlayın

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · storage data protector4 Oca 2014

  • CVE-2013-2346
    43Planlayın

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · storage data protector4 Oca 2014

  • CVE-2013-2347
    60Bu hafta

    The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a

    KritikCVSS 10,0SilahlaştırılmışEPSS %66

    hp · storage data protector4 Oca 2014

  • CVE-2013-2348
    43Planlayın

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · storage data protector4 Oca 2014

  • CVE-2013-2349
    43Planlayın

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · storage data protector4 Oca 2014

  • CVE-2013-2350
    43Planlayın

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · storage data protector4 Oca 2014

  • CVE-2013-6194
    60Bu hafta

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0SilahlaştırılmışEPSS %65

    hp · storage data protector4 Oca 2014

  • CVE-2013-6195
    43Planlayın

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service v

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · storage data protector4 Oca 2014

  • CVE-2013-6881
    44Planlayın

    CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacte

    KritikCVSS 10,0Kavram kanıtıEPSS %12

    cru-inc · ditto forensic fieldstation firmware7 Oca 2014

  • CVE-2013-6884
    43Planlayın

    The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allo

    KritikCVSS 10,0Kavram kanıtıEPSS %10

    cru-inc · ditto forensic fieldstation firmware7 Oca 2014

  • CVE-2013-4353
    21İzleyin

    The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL poin

    OrtaCVSS 4,3İstismar yokEPSS %11

    openssl · openssl8 Oca 2014

  • CVE-2013-6955
    65Bu hafta

    webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 al

    KritikCVSS 10,0SilahlaştırılmışEPSS %84

    synology · diskstation manager9 Oca 2014

  • CVE-2013-6462
    40Planlayın

    Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attacker

    KritikCVSS 9,3İstismar yokEPSS %10

    x · libxfont9 Oca 2014

  • CVE-2013-2050
    40Planlayın

    SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virt

    YüksekCVSS 7,5SilahlaştırılmışEPSS %15

    redhat · cloudforms management engine10 Oca 2014

  • CVE-2014-0659
    62Bu hafta

    The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, an

    KritikCVSS 10,0SilahlaştırılmışEPSS %73

    cisco · rvs4000 firmware12 Oca 2014

  • CVE-2014-0591
    20İzleyin

    The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV b

    DüşükCVSS 2,6İstismar yokEPSS %31

    isc · bind14 Oca 2014

  • CVE-2013-7108
    40Planlayın

    Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow

    OrtaCVSS 5,5Kavram kanıtıEPSS %61

    nagios · nagios15 Oca 2014

  • CVE-2013-2827
    44Planlayın

    An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote

    YüksekCVSS 7,5SilahlaştırılmışEPSS %48

    wellintech · kingalarm\&event15 Oca 2014

  • CVE-2014-1201
    49Planlayın

    Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 ser

    KritikCVSS 10,0Kavram kanıtıEPSS %29

    lorex technology · edge lh310 firmware15 Oca 2014

  • CVE-2013-5795
    40Planlayın

    Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0

    OrtaCVSS 5,0SilahlaştırılmışEPSS %59

    oracle · supply chain products suite15 Oca 2014

  • CVE-2013-5877
    40Planlayın

    Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0

    OrtaCVSS 5,0SilahlaştırılmışEPSS %54

    oracle · supply chain products suite15 Oca 2014

  • CVE-2013-5880
    40Planlayın

    Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 12.2.0, 12.2.1, and 12.2.

    OrtaCVSS 5,0SilahlaştırılmışEPSS %59

    oracle · supply chain products suite15 Oca 2014

  • CVE-2014-0258
    42Planlayın

    Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cau

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · office compatibility pack15 Oca 2014

  • CVE-2014-0259
    42Planlayın

    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (mem

    KritikCVSS 9,3İstismar yokEPSS %16

    microsoft · office compatibility pack15 Oca 2014

  • CVE-2014-0260
    42Planlayın

    Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 S

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · office compatibility pack15 Oca 2014

  • CVE-2014-0261
    19İzleyin

    Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage)

    OrtaCVSS 4,0İstismar yokEPSS %10

    microsoft · dynamics ax15 Oca 2014

  • CVE-2014-0496
    77Bu hafta

    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %39

    adobe · acrobat15 Oca 2014

  • CVE-2013-7204
    30İzleyin

    Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21.37.2.49 allows remo

    OrtaCVSS 6,8Kavram kanıtıEPSS %10

    conceptronic · cipcamptiwl 1.0 firmware17 Oca 2014

  • CVE-2013-3482
    46Planlayın

    Stack-based buffer overflow in the rf_report_error function in ermapper_u.dll in Intergraph ERDAS ER Viewer before 13.0.1.1301 allows remote

    KritikCVSS 9,3SilahlaştırılmışEPSS %31

    hexagon · erdas er viewer19 Oca 2014

  • CVE-2013-0340
    33İzleyin

    expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler fun

    OrtaCVSS 6,8İstismar yokEPSS %19

    libexpat project · libexpat21 Oca 2014

  • CVE-2013-4152
    35İzleyin

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, wh

    OrtaCVSS 6,8İstismar yokEPSS %25

    springsource · spring framework23 Oca 2014

  • CVE-2013-6933
    35İzleyin

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Pl

    YüksekCVSS 7,5İstismar yokEPSS %17

    live555 · streaming media23 Oca 2014

  • CVE-2013-6934
    38İzleyin

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote

    YüksekCVSS 7,5İstismar yokEPSS %28

    live555 · streaming media23 Oca 2014

  • CVE-2014-1670
    31İzleyin

    The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a craft

    OrtaCVSS 6,8İstismar yokEPSS %13

    microsoft · bing25 Oca 2014

  • CVE-2014-0750
    51Planlayın

    GE Proficy HMI/SCADA Path Traversal

    YüksekCVSS 7,5SilahlaştırılmışEPSS %69

    ge · intelligent platforms proficy hmi\%2fscada cimplicity25 Oca 2014

  • CVE-2013-7137
    44Planlayın

    The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    burden project · burden25 Oca 2014

  • CVE-2013-6429
    54Planlayın

    The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entit

    OrtaCVSS 6,8İstismar yokEPSS %90

    pivotal software · spring framework26 Oca 2014

  • CVE-2012-5192
    40Planlayın

    Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files vi

    OrtaCVSS 5,0SilahlaştırılmışEPSS %52

    bitweaver · bitweaver27 Oca 2014

  • CVE-2014-1683
    40Planlayın

    The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid pa

    OrtaCVSS 6,8SilahlaştırılmışEPSS %31

    skybluecanvas · skybluecanvas29 Oca 2014

  • CVE-2013-0177
    20İzleyin

    Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz)

    DüşükCVSS 3,5Kavram kanıtıEPSS %21

    apache · ofbiz30 Oca 2014

  • CVE-2013-7246
    40Planlayın

    Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to

    KritikCVSS 9,3Kavram kanıtıEPSS %11

    daum communications · daumgame activex control30 Oca 2014

  • CVE-2014-1610
    40Planlayın

    MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows rem

    OrtaCVSS 6,0SilahlaştırılmışEPSS %42

    mediawiki · mediawiki30 Oca 2014