İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2014: sömürülen ve yeni ciddi CVE kayıtları

39 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2014-3000
    35İzleyin

    The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 a

    YüksekCVSS 7,8İstismar yokEPSS %12

    freebsd · freebsd2 May 2014

  • CVE-2014-3220
    39İzleyin

    F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name pa

    KritikCVSS 9,0Kavram kanıtıEPSS %11

    f5 · big-iq5 May 2014

  • CVE-2014-0198
    29İzleyin

    The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a b

    OrtaCVSS 4,3İstismar yokEPSS %40

    openssl · openssl6 May 2014

  • CVE-2014-0130
    76Bu hafta

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails befor

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %53

    redhat · subscription asset manager7 May 2014

  • CVE-2014-0196
    59Planlayın

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %22

    linux · linux kernel7 May 2014

  • CVE-2014-2913
    35İzleyin

    Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arb

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    nagios · remote plugin executor7 May 2014

  • CVE-2014-3214
    25İzleyin

    The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial o

    OrtaCVSS 5,0İstismar yokEPSS %17

    isc · bind8 May 2014

  • CVE-2014-2928
    40Planlayın

    The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.

    YüksekCVSS 7,1SilahlaştırılmışEPSS %40

    f5 · big-ip webaccelerator12 May 2014

  • CVE-2013-4490
    40Planlayın

    The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allow

    OrtaCVSS 6,5SilahlaştırılmışEPSS %42

    gitlab · gitlab13 May 2014

  • CVE-2014-1849
    44Planlayın

    Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdo

    KritikCVSS 10,0Kavram kanıtıEPSS %12

    foscam · ip camera firmware13 May 2014

  • CVE-2014-0251
    40Planlayın

    Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 20

    KritikCVSS 9,0İstismar yokEPSS %14

    microsoft · office web apps server14 May 2014

  • CVE-2014-0255
    33İzleyin

    Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (iSCSI service

    OrtaCVSS 5,0İstismar yokEPSS %41

    microsoft · windows server 200814 May 2014

  • CVE-2014-0256
    33İzleyin

    Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold allow remote attackers to cause a denial of service (iSCSI service outage)

    OrtaCVSS 5,0İstismar yokEPSS %41

    microsoft · windows server 200814 May 2014

  • CVE-2014-0310
    42Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · internet explorer14 May 2014

  • CVE-2014-0527
    44Planlayın

    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to

    KritikCVSS 10,0İstismar yokEPSS %13

    adobe · acrobat14 May 2014

  • CVE-2014-1754
    20İzleyin

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office W

    OrtaCVSS 4,3İstismar yokEPSS %11

    microsoft · office web apps server14 May 2014

  • CVE-2014-1806
    52Planlayın

    The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memo

    KritikCVSS 10,0Kavram kanıtıEPSS %39

    microsoft · .net framework14 May 2014

  • CVE-2014-1808
    20İzleyin

    Microsoft Office 2013 Gold, SP1, RT, and RT SP1 allows remote attackers to obtain sensitive token information via a web site that sends a cr

    OrtaCVSS 4,3İstismar yokEPSS %10

    microsoft · office14 May 2014

  • CVE-2014-1809
    30İzleyin

    The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers

    OrtaCVSS 6,8İstismar yokEPSS %10

    microsoft · office14 May 2014

  • CVE-2014-1812
    85Hemen

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, a

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %65

    microsoft · windows 714 May 2014

  • CVE-2014-1813
    37İzleyin

    Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content, aka "Web A

    YüksekCVSS 8,5İstismar yokEPSS %10

    microsoft · web applications14 May 2014

  • CVE-2014-1815
    43Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3Kavram kanıtıEPSS %20

    microsoft · internet explorer14 May 2014

  • CVE-2013-4468
    40Planlayın

    VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands

    OrtaCVSS 6,5SilahlaştırılmışEPSS %32

    vicidial · vicidial14 May 2014

  • CVE-2013-4730
    60Bu hafta

    Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.

    KritikCVSS 10,0SilahlaştırılmışEPSS %66

    pcman · ftp server15 May 2014

  • CVE-2014-0782
    50Planlayın

    Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow

    YüksekCVSS 8,3SilahlaştırılmışEPSS %56

    yokogawa · b\/m9000cs software16 May 2014

  • CVE-2014-1649
    44Planlayın

    The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a cra

    YüksekCVSS 7,9SilahlaştırılmışEPSS %42

    symantec · workspace streaming16 May 2014

  • CVE-2014-0749
    45Planlayın

    Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x

    KritikCVSS 10,0Kavram kanıtıEPSS %17

    adaptivecomputing · torque resource manager16 May 2014

  • CVE-2014-3791
    64Bu hafta

    Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in

    KritikCVSS 10,0SilahlaştırılmışEPSS %78

    efssoft · easy file sharing web server20 May 2014

  • CVE-2014-3802
    30İzleyin

    msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate a

    OrtaCVSS 6,8İstismar yokEPSS %10

    microsoft · debug interface access software development kit20 May 2014

  • CVE-2014-1770
    47Planlayın

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaS

    KritikCVSS 9,3Kavram kanıtıEPSS %34

    microsoft · internet explorer22 May 2014

  • CVE-2014-3789
    49Planlayın

    GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspeci

    YüksekCVSS 7,5SilahlaştırılmışEPSS %63

    cogentdatahub · cogent datahub22 May 2014

  • CVE-2010-5299
    40Planlayın

    Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file.

    OrtaCVSS 6,8SilahlaştırılmışEPSS %33

    microp project · microp22 May 2014

  • CVE-2013-3975
    40Planlayın

    Unspecified vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to disco

    OrtaCVSS 5,0SilahlaştırılmışEPSS %13

    ibm · sametime26 May 2014

  • CVE-2013-3977
    40Planlayın

    The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are

    OrtaCVSS 4,3SilahlaştırılmışEPSS %9

    ibm · sametime26 May 2014

  • CVE-2013-3982
    40Planlayın

    The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to obtain unspecified installation in

    OrtaCVSS 5,0SilahlaştırılmışEPSS %13

    ibm · sametime26 May 2014

  • CVE-2013-5036
    44Planlayın

    The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation

    YüksekCVSS 7,5SilahlaştırılmışEPSS %46

    squash · square squash27 May 2014

  • CVE-2014-0239
    40Planlayın

    The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sendi

    OrtaCVSS 5,0İstismar yokEPSS %66

    samba · samba28 May 2014

  • CVE-2012-4915
    40Planlayın

    Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary fil

    OrtaCVSS 5,0SilahlaştırılmışEPSS %50

    wordpress · wordpress29 May 2014

  • CVE-2014-0075
    25İzleyin

    Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6

    OrtaCVSS 5,0Kavram kanıtıEPSS %17

    apache · tomcat31 May 2014