İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2014: sömürülen ve yeni ciddi CVE kayıtları

51 kayıt · 6 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2014-2044
    34İzleyin

    Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    owncloud · owncloud6 Eki 2014

  • CVE-2014-6287
    99Hemen

    The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attacke

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    rejetto · http file server7 Eki 2014

  • CVE-2014-7235
    53Planlayın

    htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 bef

    KritikCVSS 10,0Kavram kanıtıEPSS %43

    freepbx · freepbx7 Eki 2014

  • CVE-2014-7205
    64Bu hafta

    Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server frame

    KritikCVSS 10,0SilahlaştırılmışEPSS %78

    bassmaster project · bassmaster8 Eki 2014

  • CVE-2014-7981
    40Planlayın

    SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspec

    YüksekCVSS 7,5SilahlaştırılmışEPSS %8

    joomla · joomla\!8 Eki 2014

  • CVE-2014-3581
    24İzleyin

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows re

    OrtaCVSS 5,0İstismar yokEPSS %13

    apache · http server10 Eki 2014

  • CVE-2014-4872
    54Planlayın

    BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute

    YüksekCVSS 7,5SilahlaştırılmışEPSS %79

    bmc · track-it\!10 Eki 2014

  • CVE-2014-3566
    60Bu hafta

    The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man

    DüşükCVSS 3,4SilahlaştırılmışEPSS %99

    openssl · openssl14 Eki 2014

  • CVE-2014-0569
    64Bu hafta

    Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on

    KritikCVSS 9,3SilahlaştırılmışEPSS %91

    adobe · flash player15 Eki 2014

  • CVE-2014-4073
    47Planlayın

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce insta

    KritikCVSS 10,0İstismar yokEPSS %23

    microsoft · .net framework15 Eki 2014

  • CVE-2014-4075
    23İzleyin

    Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remot

    OrtaCVSS 4,3İstismar yokEPSS %20

    microsoft · asp.net model view controller15 Eki 2014

  • CVE-2014-4113
    87Hemen

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %86

    microsoft · windows 715 Eki 2014

  • CVE-2014-4114
    85Hemen

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %81

    microsoft · windows 715 Eki 2014

  • CVE-2014-4117
    42Planlayın

    Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · office15 Eki 2014

  • CVE-2014-4121
    46Planlayın

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized resource identifiers, which

    KritikCVSS 10,0İstismar yokEPSS %19

    microsoft · .net framework15 Eki 2014

  • CVE-2014-4122
    21İzleyin

    Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 omits the ASLR protection mechanism, which allows remote attackers to obtain potentially se

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · .net framework15 Eki 2014

  • CVE-2014-4123
    79Bu hafta

    Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %47

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4124
    30İzleyin

    Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation

    OrtaCVSS 6,8İstismar yokEPSS %11

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4126
    43Planlayın

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    KritikCVSS 9,3İstismar yokEPSS %21

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4127
    42Planlayın

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %16

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4128
    42Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4129
    44Planlayın

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %24

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4130
    42Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4132
    42Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %16

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4133
    42Planlayın

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    KritikCVSS 9,3İstismar yokEPSS %16

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4134
    42Planlayın

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4137
    44Planlayın

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4138
    47Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3Kavram kanıtıEPSS %32

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4140
    23İzleyin

    Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern

    OrtaCVSS 4,3Kavram kanıtıEPSS %20

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4141
    46Planlayın

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3Kavram kanıtıEPSS %30

    microsoft · internet explorer15 Eki 2014

  • CVE-2014-4148
    83Hemen

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %59

    microsoft · windows 715 Eki 2014

  • CVE-2014-4278
    33İzleyin

    Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, a

    YüksekCVSS 7,5İstismar yokEPSS %10

    oracle · e-business suite15 Eki 2014

  • CVE-2014-3704
    60Bu hafta

    The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements,

    YüksekCVSS 7,5SilahlaştırılmışEPSS %99

    drupal · drupal15 Eki 2014

  • CVE-2014-7237
    33İzleyin

    lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and

    OrtaCVSS 6,8İstismar yokEPSS %20

    twiki · twiki15 Eki 2014

  • CVE-2014-3513
    39İzleyin

    Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (mem

    YüksekCVSS 7,1İstismar yokEPSS %37

    openssl · openssl18 Eki 2014

  • CVE-2014-3567
    35İzleyin

    Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows re

    YüksekCVSS 7,1İstismar yokEPSS %22

    openssl · openssl18 Eki 2014

  • CVE-2014-3568
    21İzleyin

    OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote

    OrtaCVSS 4,3İstismar yokEPSS %13

    openssl · openssl18 Eki 2014

  • CVE-2014-6308
    27İzleyin

    Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a ..

    OrtaCVSS 5,0Kavram kanıtıEPSS %22

    osclass · osclass20 Eki 2014

  • CVE-2014-7140
    35İzleyin

    Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x b

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    citrix · netscaler application delivery controller firmware21 Eki 2014

  • CVE-2014-5005
    53Planlayın

    Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar

    YüksekCVSS 7,5SilahlaştırılmışEPSS %77

    zohocorp · manageengine desktop central21 Eki 2014

  • CVE-2014-5006
    38İzleyin

    Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar

    YüksekCVSS 7,5Kavram kanıtıEPSS %25

    zohocorp · manageengine desktop central21 Eki 2014

  • CVE-2014-6352
    84Hemen

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %77

    microsoft · windows 722 Eki 2014

  • CVE-2014-3828
    62Bu hafta

    Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attac

    KritikCVSS 10,0SilahlaştırılmışEPSS %72

    merethis · centreon22 Eki 2014

  • CVE-2014-3829
    64Bu hafta

    displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execu

    KritikCVSS 10,0SilahlaştırılmışEPSS %80

    merethis · centreon22 Eki 2014

  • CVE-2014-0476
    40Planlayın

    The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a

    DüşükCVSS 3,7SilahlaştırılmışEPSS %3

    chkrootkit · chkrootkit25 Eki 2014

  • CVE-2014-6037
    55Planlayın

    Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows

    YüksekCVSS 7,5SilahlaştırılmışEPSS %84

    zohocorp · manageengine eventlog analyzer26 Eki 2014

  • CVE-2014-3668
    28İzleyin

    Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before

    OrtaCVSS 5,0İstismar yokEPSS %27

    php · php29 Eki 2014

  • CVE-2014-3669
    39İzleyin

    Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x befor

    YüksekCVSS 7,5İstismar yokEPSS %28

    php · php29 Eki 2014

  • CVE-2014-3670
    34İzleyin

    The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates

    OrtaCVSS 6,8İstismar yokEPSS %22

    php · php29 Eki 2014

  • CVE-2014-4877
    49Planlayın

    Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary fi

    KritikCVSS 9,3SilahlaştırılmışEPSS %39

    gnu · wget29 Eki 2014

  • CVE-2013-7409
    50Planlayın

    Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary

    YüksekCVSS 7,5SilahlaştırılmışEPSS %67

    allplayer · allplayer30 Eki 2014