İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2014: sömürülen ve yeni ciddi CVE kayıtları

66 kayıt · 4 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2014-7228
    47Planlayın

    Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla!

    YüksekCVSS 7,5SilahlaştırılmışEPSS %55

    joomla · joomla\!3 Kas 2014

  • CVE-2014-8586
    42Planlayın

    SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL c

    YüksekCVSS 7,5SilahlaştırılmışEPSS %40

    cp multi view event calendar project · cp multi view event calendar4 Kas 2014

  • CVE-2014-3710
    24İzleyin

    The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note

    OrtaCVSS 5,0İstismar yokEPSS %14

    php · php5 Kas 2014

  • CVE-2014-0995
    23İzleyin

    The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled re

    OrtaCVSS 5,0Kavram kanıtıEPSS %10

    sap · netweaver6 Kas 2014

  • CVE-2014-8656
    43Planlayın

    The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (

    KritikCVSS 10,0Kavram kanıtıEPSS %10

    compal broadband networks · firmware6 Kas 2014

  • CVE-2014-5258
    22İzleyin

    Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitr

    OrtaCVSS 4,0Kavram kanıtıEPSS %20

    webedition · webedition cms6 Kas 2014

  • CVE-2014-4076
    40Planlayın

    Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TC

    YüksekCVSS 7,2SilahlaştırılmışEPSS %22

    microsoft · windows server 200311 Kas 2014

  • CVE-2014-4077
    77Bu hafta

    Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.E

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %54

    microsoft · office 2007 ime11 Kas 2014

  • CVE-2014-4078
    26İzleyin

    The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules

    OrtaCVSS 5,1İstismar yokEPSS %20

    microsoft · internet information services11 Kas 2014

  • CVE-2014-4118
    41Planlayın

    XML Core Services (aka MSXML) 3.0 in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · windows 711 Kas 2014

  • CVE-2014-4143
    43Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-4149
    43Planlayın

    Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allo

    KritikCVSS 9,3İstismar yokEPSS %21

    microsoft · .net framework11 Kas 2014

  • CVE-2014-6317
    34İzleyin

    Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2

    YüksekCVSS 7,1İstismar yokEPSS %18

    microsoft · windows 711 Kas 2014

  • CVE-2014-6318
    20İzleyin

    The audit logon feature in Remote Desktop Protocol (RDP) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,

    OrtaCVSS 4,3İstismar yokEPSS %11

    microsoft · windows 711 Kas 2014

  • CVE-2014-6321
    69Bu hafta

    Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,

    KritikCVSS 10,0İstismar yokEPSS %95

    microsoft · windows 711 Kas 2014

  • CVE-2014-6322
    21İzleyin

    The Windows Audio service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows

    OrtaCVSS 4,3İstismar yokEPSS %12

    microsoft · windows 711 Kas 2014

  • CVE-2014-6323
    21İzleyin

    Microsoft Internet Explorer 7 through 11 allows remote attackers to obtain sensitive clipboard information via a crafted web site, aka "Inte

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6331
    26İzleyin

    Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, do

    OrtaCVSS 5,0İstismar yokEPSS %20

    microsoft · active directory federation services11 Kas 2014

  • CVE-2014-6332
    93Hemen

    OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, W

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %94

    microsoft · windows 711 Kas 2014

  • CVE-2014-6333
    42Planlayın

    Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Offic

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · office compatibility pack11 Kas 2014

  • CVE-2014-6334
    42Planlayın

    Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o

    KritikCVSS 9,3İstismar yokEPSS %17

    microsoft · office compatibility pack11 Kas 2014

  • CVE-2014-6335
    42Planlayın

    Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o

    KritikCVSS 9,3İstismar yokEPSS %16

    microsoft · office compatibility pack11 Kas 2014

  • CVE-2014-6337
    42Planlayın

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6339
    24İzleyin

    Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Ex

    OrtaCVSS 5,0İstismar yokEPSS %11

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6340
    26İzleyin

    Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s

    OrtaCVSS 4,3İstismar yokEPSS %28

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6341
    42Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6342
    42Planlayın

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6343
    42Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6344
    42Planlayın

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6345
    26İzleyin

    Microsoft Internet Explorer 9 and 10 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site,

    OrtaCVSS 4,3İstismar yokEPSS %30

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6346
    21İzleyin

    Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web s

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6347
    42Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6348
    42Planlayın

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6349
    20İzleyin

    Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of

    OrtaCVSS 4,3İstismar yokEPSS %10

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6350
    23İzleyin

    Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of

    OrtaCVSS 4,3İstismar yokEPSS %20

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6351
    44Planlayın

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-6353
    42Planlayın

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer11 Kas 2014

  • CVE-2014-0582
    43Planlayın

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.2

    KritikCVSS 10,0İstismar yokEPSS %11

    adobe · flash player11 Kas 2014

  • CVE-2014-8440
    65Bu hafta

    Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR bef

    KritikCVSS 10,0SilahlaştırılmışEPSS %81

    adobe · flash player11 Kas 2014

  • CVE-2014-1635
    60Bu hafta

    Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute

    KritikCVSS 10,0SilahlaştırılmışEPSS %67

    belkin · n750 wireless router firmware12 Kas 2014

  • CVE-2014-5424
    33İzleyin

    Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application cr

    YüksekCVSS 7,5İstismar yokEPSS %11

    rockwellautomation · connected components workbench13 Kas 2014

  • CVE-2014-7878
    43Planlayın

    The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node im

    KritikCVSS 10,0İstismar yokEPSS %10

    hp · helion cloud development platform13 Kas 2014

  • CVE-2014-2268
    40Planlayın

    views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers

    OrtaCVSS 5,0SilahlaştırılmışEPSS %31

    vtiger · vtiger crm15 Kas 2014

  • CVE-2014-8498
    30İzleyin

    SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service P

    OrtaCVSS 6,5Kavram kanıtıEPSS %12

    zohocorp · manageengine password manager pro17 Kas 2014

  • CVE-2014-8499
    40Planlayın

    Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) e

    OrtaCVSS 6,5SilahlaştırılmışEPSS %36

    manageengine · password manager pro17 Kas 2014

  • CVE-2014-8517
    51Planlayın

    The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 t

    YüksekCVSS 7,5SilahlaştırılmışEPSS %69

    netbsd · netbsd17 Kas 2014

  • CVE-2014-7992
    40Planlayın

    The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential inform

    OrtaCVSS 5,0SilahlaştırılmışEPSS %27

    cisco · ios17 Kas 2014

  • CVE-2014-7146
    45Planlayın

    The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) descriptio

    YüksekCVSS 7,5SilahlaştırılmışEPSS %50

    mantisbt · mantisbt18 Kas 2014

  • CVE-2014-8598
    40Planlayın

    The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via

    OrtaCVSS 6,4SilahlaştırılmışEPSS %38

    mantisbt · mantisbt18 Kas 2014

  • CVE-2014-6324
    91Hemen

    The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wind

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %87

    microsoft · windows 718 Kas 2014

  • CVE-2014-8387
    45Planlayın

    cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell

    KritikCVSS 9,0Kavram kanıtıEPSS %30

    advantech · eki-6340 firmware20 Kas 2014

  • CVE-2014-8998
    40Planlayın

    lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header t

    OrtaCVSS 6,5SilahlaştırılmışEPSS %35

    x7chat · x7 chat20 Kas 2014

  • CVE-2014-3625
    23İzleyin

    Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2

    OrtaCVSS 5,0Kavram kanıtıEPSS %10

    pivotal software · spring framework20 Kas 2014

  • CVE-2014-8768
    26İzleyin

    Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cau

    OrtaCVSS 5,0Kavram kanıtıEPSS %19

    opensuse · opensuse20 Kas 2014

  • CVE-2014-8682
    40Planlayın

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to e

    YüksekCVSS 7,5Kavram kanıtıEPSS %33

    gogits · gogs21 Kas 2014

  • CVE-2014-9016
    45Planlayın

    The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allo

    OrtaCVSS 5,0SilahlaştırılmışEPSS %82

    drupal · drupal24 Kas 2014

  • CVE-2010-5312
    30İzleyin

    Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to i

    OrtaCVSS 6,1İstismar yokEPSS %18

    debian · debian linux24 Kas 2014

  • CVE-2014-8420
    43Planlayın

    The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicW

    KritikCVSS 9,0SilahlaştırılmışEPSS %23

    sonicwall · analyzer25 Kas 2014

  • CVE-2014-8439
    71Bu hafta

    Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR bef

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %20

    adobe · flash player25 Kas 2014

  • CVE-2014-9034
    45Planlayın

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers

    OrtaCVSS 5,0Kavram kanıtıEPSS %82

    wordpress · wordpress25 Kas 2014

  • CVE-2014-7141
    48Planlayın

    The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds rea

    OrtaCVSS 6,4İstismar yokEPSS %76

    squid-cache · squid26 Kas 2014

  • CVE-2014-7142
    32İzleyin

    The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a craf

    OrtaCVSS 6,4İstismar yokEPSS %24

    oracle · solaris26 Kas 2014

  • CVE-2014-8423
    59Planlayın

    Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via

    KritikCVSS 10,0SilahlaştırılmışEPSS %62

    arris · vap2500 firmware28 Kas 2014

  • CVE-2014-8424
    49Planlayın

    ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %59

    arris · vap2500 firmware28 Kas 2014

  • CVE-2014-8799
    41Planlayın

    Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress a

    OrtaCVSS 5,0SilahlaştırılmışEPSS %68

    dukapress · dukapress28 Kas 2014

  • CVE-2014-8801
    25İzleyin

    Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attac

    OrtaCVSS 5,0Kavram kanıtıEPSS %18

    strangerstudios · paid memberships pro28 Kas 2014