İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2014: sömürülen ve yeni ciddi CVE kayıtları

50 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2013-0662
    44Planlayın

    Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to

    KritikCVSS 9,3Kavram kanıtıEPSS %22

    schneider electric · somachine1 Nis 2014

  • CVE-2014-0050
    60Bu hafta

    MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attac

    YüksekCVSS 7,5SilahlaştırılmışEPSS %83

    apache · commons fileupload1 Nis 2014

  • CVE-2014-1691
    43Planlayın

    The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object inject

    YüksekCVSS 7,5SilahlaştırılmışEPSS %42

    horde · horde application framework1 Nis 2014

  • CVE-2012-6429
    45Planlayın

    Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7 allows remote attack

    KritikCVSS 10,0Kavram kanıtıEPSS %15

    samsung · kies4 Nis 2014

  • CVE-2014-2730
    23İzleyin

    The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during

    OrtaCVSS 5,0İstismar yokEPSS %11

    microsoft · office5 Nis 2014

  • CVE-2014-0160
    90Hemen

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    openssl · openssl7 Nis 2014

  • CVE-2014-0315
    31İzleyin

    Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2

    OrtaCVSS 6,9İstismar yokEPSS %14

    microsoft · windows 78 Nis 2014

  • CVE-2014-1751
    43Planlayın

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer8 Nis 2014

  • CVE-2014-1752
    43Planlayın

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer8 Nis 2014

  • CVE-2014-1753
    43Planlayın

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer8 Nis 2014

  • CVE-2014-1755
    43Planlayın

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer8 Nis 2014

  • CVE-2014-1757
    42Planlayın

    Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a bi

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · office compatibility pack8 Nis 2014

  • CVE-2014-1758
    42Planlayın

    Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Micros

    KritikCVSS 9,3İstismar yokEPSS %16

    microsoft · word8 Nis 2014

  • CVE-2014-1759
    41Planlayın

    pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (inc

    KritikCVSS 9,3İstismar yokEPSS %14

    microsoft · publisher8 Nis 2014

  • CVE-2014-1760
    41Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer8 Nis 2014

  • CVE-2014-2127
    40Planlayın

    Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0

    YüksekCVSS 8,5SilahlaştırılmışEPSS %11

    cisco · adaptive security appliance software10 Nis 2014

  • CVE-2014-2849
    52Planlayın

    The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin

    YüksekCVSS 8,5SilahlaştırılmışEPSS %60

    sophos · web appliance firmware11 Nis 2014

  • CVE-2014-2850
    51Planlayın

    The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitra

    YüksekCVSS 8,5SilahlaştırılmışEPSS %57

    sophos · web appliance firmware11 Nis 2014

  • CVE-2014-0763
    40Planlayın

    Advantech WebAccess SQL Injection

    YüksekCVSS 7,5SilahlaştırılmışEPSS %15

    advantech · advantech webaccess12 Nis 2014

  • CVE-2014-0787
    44Planlayın

    WellinTech KingSCADA Stack-based Buffer Overflow

    KritikCVSS 10,0Kavram kanıtıEPSS %14

    wellintech · kingscada12 Nis 2014

  • CVE-2014-0128
    30İzleyin

    Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion fail

    OrtaCVSS 5,0İstismar yokEPSS %32

    squid-cache · squid14 Nis 2014

  • CVE-2010-5298
    26İzleyin

    Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remot

    OrtaCVSS 4,0İstismar yokEPSS %34

    openssl · openssl14 Nis 2014

  • CVE-2013-5704
    36İzleyin

    The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a head

    OrtaCVSS 5,0İstismar yokEPSS %52

    apache · http server15 Nis 2014

  • CVE-2014-0107
    34İzleyin

    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESS

    YüksekCVSS 7,5İstismar yokEPSS %14

    apache · xalan-java15 Nis 2014

  • CVE-2014-0514
    59Planlayın

    The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to e

    KritikCVSS 9,3SilahlaştırılmışEPSS %72

    adobe · adobe reader15 Nis 2014

  • CVE-2014-2424
    40Planlayın

    Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users

    OrtaCVSS 4,0SilahlaştırılmışEPSS %48

    oracle · fusion middleware15 Nis 2014

  • CVE-2013-4694
    35İzleyin

    Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash)

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    nullsoft · winamp16 Nis 2014

  • CVE-2014-0644
    47Planlayın

    EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML

    YüksekCVSS 7,8SilahlaştırılmışEPSS %53

    emc · cloud tiering appliance software16 Nis 2014

  • CVE-2013-2143
    40Planlayın

    The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which

    OrtaCVSS 6,5SilahlaştırılmışEPSS %48

    redhat · network satellite17 Nis 2014

  • CVE-2014-0054
    54Planlayın

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external ent

    OrtaCVSS 6,8İstismar yokEPSS %91

    springsource · spring framework17 Nis 2014

  • CVE-2014-2286
    35İzleyin

    main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x befo

    YüksekCVSS 7,5İstismar yokEPSS %16

    digium · asterisk18 Nis 2014

  • CVE-2013-6213
    43Planlayın

    Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · loadrunner19 Nis 2014

  • CVE-2014-2269
    30İzleyin

    modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via

    OrtaCVSS 6,4İstismar yokEPSS %15

    vtiger · vtiger crm22 Nis 2014

  • CVE-2011-5279
    26İzleyin

    CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Window

    OrtaCVSS 5,0İstismar yokEPSS %19

    microsoft · internet information services23 Nis 2014

  • CVE-2014-0780
    91Hemen

    InduSoft Web Studio Path Traversal

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %74

    indusoft · web studio25 Nis 2014

  • CVE-2014-2908
    23İzleyin

    Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attac

    OrtaCVSS 4,3Kavram kanıtıEPSS %20

    siemens · simatic s7 cpu 1200 firmware25 Nis 2014

  • CVE-2013-5660
    40Planlayın

    Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file.

    KritikCVSS 9,3Kavram kanıtıEPSS %11

    powersoftware · winarchiver25 Nis 2014

  • CVE-2014-2994
    47Planlayın

    Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code v

    KritikCVSS 10,0Kavram kanıtıEPSS %23

    acunetix · web vulnerability scanner27 Nis 2014

  • CVE-2014-1762
    51Planlayın

    Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrit

    YüksekCVSS 7,5Kavram kanıtıEPSS %71

    microsoft · internet explorer27 Nis 2014

  • CVE-2014-1763
    47Planlayın

    Use-after-free vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code and bypass a sand

    KritikCVSS 10,0İstismar yokEPSS %22

    microsoft · internet explorer27 Nis 2014

  • CVE-2014-1764
    51Planlayın

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leve

    KritikCVSS 10,0Kavram kanıtıEPSS %37

    microsoft · internet explorer27 Nis 2014

  • CVE-2014-1765
    35İzleyin

    Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 6 through 11 allow remote attackers to execute arbitrary code via uns

    YüksekCVSS 7,6İstismar yokEPSS %15

    microsoft · internet explorer27 Nis 2014

  • CVE-2014-1766
    47Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3Kavram kanıtıEPSS %33

    microsoft · internet explorer27 Nis 2014

  • CVE-2014-1776
    94Hemen

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %82

    microsoft · internet explorer27 Nis 2014

  • CVE-2014-3007
    43Planlayın

    Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharact

    KritikCVSS 10,0İstismar yokEPSS %10

    python · pillow27 Nis 2014

  • CVE-2014-2383
    39İzleyin

    dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and re

    OrtaCVSS 6,8Kavram kanıtıEPSS %39

    dompdf · dompdf28 Nis 2014

  • CVE-2014-0112
    59Planlayın

    ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers

    YüksekCVSS 7,5SilahlaştırılmışEPSS %98

    apache · struts29 Nis 2014

  • CVE-2014-0113
    53Planlayın

    CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getCla

    YüksekCVSS 7,5Kavram kanıtıEPSS %78

    apache · struts29 Nis 2014

  • CVE-2014-0515
    68Bu hafta

    Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.2

    KritikCVSS 10,0SilahlaştırılmışEPSS %94

    adobe · flash player29 Nis 2014

  • CVE-2014-0114
    60Bu hafta

    Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir

    YüksekCVSS 7,5SilahlaştırılmışEPSS %99

    apache · commons beanutils30 Nis 2014