İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2014: sömürülen ve yeni ciddi CVE kayıtları

72 kayıt · 1 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2014-7816
    40Planlayın

    Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running

    OrtaCVSS 5,0SilahlaştırılmışEPSS %25

    redhat · undertow1 Ara 2014

  • CVE-2014-8791
    40Planlayın

    project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP

    OrtaCVSS 6,0SilahlaştırılmışEPSS %14

    enalean · tuleap1 Ara 2014

  • CVE-2014-5445
    49Planlayın

    Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attacker

    OrtaCVSS 5,0SilahlaştırılmışEPSS %98

    zohocorp · manageengine it3604 Ara 2014

  • CVE-2014-5446
    36İzleyin

    Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow

    OrtaCVSS 5,0Kavram kanıtıEPSS %54

    zohocorp · manageengine it3604 Ara 2014

  • CVE-2014-6034
    44Planlayın

    Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpM

    OrtaCVSS 5,0SilahlaştırılmışEPSS %78

    zohocorp · manageengine social it plus4 Ara 2014

  • CVE-2014-6035
    39İzleyin

    Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attacker

    YüksekCVSS 7,5Kavram kanıtıEPSS %28

    zohocorp · manageengine opmanager4 Ara 2014

  • CVE-2014-6036
    36İzleyin

    Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and

    OrtaCVSS 6,4Kavram kanıtıEPSS %36

    zohocorp · manageengine opmanager4 Ara 2014

  • CVE-2014-7867
    42Planlayın

    SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 a

    YüksekCVSS 7,5İstismar yokEPSS %39

    zohocorp · manageengine opmanager4 Ara 2014

  • CVE-2014-7868
    52Planlayın

    Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remo

    YüksekCVSS 7,5Kavram kanıtıEPSS %73

    zohocorp · manageengine social it plus4 Ara 2014

  • CVE-2014-3996
    42Planlayın

    SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Pro

    YüksekCVSS 7,5SilahlaştırılmışEPSS %38

    manageengine · it3605 Ara 2014

  • CVE-2014-3997
    34İzleyin

    SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    zohocorp · manageengine password manager pro5 Ara 2014

  • CVE-2014-8877
    44Planlayın

    The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for

    KritikCVSS 10,0Kavram kanıtıEPSS %14

    creative minds · cm download manager5 Ara 2014

  • CVE-2014-4880
    51Planlayın

    Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arb

    YüksekCVSS 7,5SilahlaştırılmışEPSS %70

    hikvision · dvr ds-7204 firmware8 Ara 2014

  • CVE-2014-9218
    23İzleyin

    libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to ca

    OrtaCVSS 5,0Kavram kanıtıEPSS %11

    phpmyadmin · phpmyadmin8 Ara 2014

  • CVE-2014-9029
    35İzleyin

    Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and e

    YüksekCVSS 7,5İstismar yokEPSS %18

    jasper project · jasper8 Ara 2014

  • CVE-2014-9130
    24İzleyin

    scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause

    OrtaCVSS 5,0İstismar yokEPSS %13

    pyyaml · libyaml8 Ara 2014

  • CVE-2014-8730
    21İzleyin

    The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11

    OrtaCVSS 4,3İstismar yokEPSS %13

    f5 · big-ip local traffic manager9 Ara 2014

  • CVE-2014-8601
    41Planlayın

    PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance

    OrtaCVSS 5,0İstismar yokEPSS %68

    powerdns · recursor10 Ara 2014

  • CVE-2014-7866
    54Planlayın

    Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT

    YüksekCVSS 7,5Kavram kanıtıEPSS %79

    zohocorp · manageengine social it plus10 Ara 2014

  • CVE-2014-8449
    44Planlayın

    Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arb

    KritikCVSS 10,0İstismar yokEPSS %14

    adobe · acrobat reader10 Ara 2014

  • CVE-2014-8452
    25İzleyin

    Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to read arbitrary files via

    OrtaCVSS 5,0İstismar yokEPSS %17

    adobe · acrobat reader10 Ara 2014

  • CVE-2014-8453
    24İzleyin

    Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to bypass the Same Origin Po

    OrtaCVSS 5,0İstismar yokEPSS %12

    adobe · acrobat10 Ara 2014

  • CVE-2014-8457
    44Planlayın

    Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to e

    KritikCVSS 10,0İstismar yokEPSS %12

    adobe · acrobat10 Ara 2014

  • CVE-2014-9163
    67Bu hafta

    Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %20

    adobe · flash player10 Ara 2014

  • CVE-2014-6327
    41Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6328
    26İzleyin

    Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d

    OrtaCVSS 5,0İstismar yokEPSS %21

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6329
    43Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6330
    44Planlayın

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %23

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6355
    30İzleyin

    The Graphics Component in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8

    OrtaCVSS 5,0İstismar yokEPSS %34

    microsoft · windows 710 Ara 2014

  • CVE-2014-6356
    41Planlayın

    Array index error in Microsoft Word 2007 SP3, Word 2010 SP2, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary

    KritikCVSS 9,3İstismar yokEPSS %11

    microsoft · office compatibility pack10 Ara 2014

  • CVE-2014-6357
    43Planlayın

    Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and SP1, Office 2013 RT Gold and SP1, Office for Mac 2011, Word

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · office10 Ara 2014

  • CVE-2014-6360
    41Planlayın

    Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack allow remote attackers to execute arbitrary code via a crafted Offic

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · excel10 Ara 2014

  • CVE-2014-6361
    41Planlayın

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 Gold and SP1, Excel 2013 RT Gold and SP1, and Office Compatibility Pack allow remote at

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · excel10 Ara 2014

  • CVE-2014-6363
    46Planlayın

    vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers

    KritikCVSS 9,3Kavram kanıtıEPSS %28

    microsoft · vbscript10 Ara 2014

  • CVE-2014-6364
    41Planlayın

    Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, and SP2; and 2013 RT Gold and SP1 allows remote attacke

    KritikCVSS 9,3İstismar yokEPSS %14

    microsoft · office10 Ara 2014

  • CVE-2014-6365
    24İzleyin

    Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d

    OrtaCVSS 4,3İstismar yokEPSS %24

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6366
    44Planlayın

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    KritikCVSS 9,3İstismar yokEPSS %23

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6368
    21İzleyin

    Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explore

    OrtaCVSS 4,3İstismar yokEPSS %12

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6369
    44Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %24

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6373
    41Planlayın

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6374
    41Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6375
    41Planlayın

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-6376
    41Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-8966
    41Planlayın

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · internet explorer10 Ara 2014

  • CVE-2014-8500
    48Planlayın

    ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attacke

    YüksekCVSS 7,8İstismar yokEPSS %57

    isc · bind10 Ara 2014

  • CVE-2014-8602
    27İzleyin

    iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service

    OrtaCVSS 4,3İstismar yokEPSS %32

    nlnetlabs · unbound10 Ara 2014

  • CVE-2014-7192
    44Planlayın

    Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application De

    KritikCVSS 10,0Kavram kanıtıEPSS %13

    joyent · node.js11 Ara 2014

  • CVE-2014-8270
    40Planlayın

    BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a

    OrtaCVSS 5,0SilahlaştırılmışEPSS %19

    bmc · track-it\!12 Ara 2014

  • CVE-2014-3583
    23İzleyin

    The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers

    OrtaCVSS 5,0İstismar yokEPSS %10

    apache · http server15 Ara 2014

  • CVE-2014-6261
    43Planlayın

    Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary c

    KritikCVSS 9,3İstismar yokEPSS %19

    zenoss · zenoss core15 Ara 2014

  • CVE-2014-7911
    35İzleyin

    luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify th

    YüksekCVSS 7,2Kavram kanıtıEPSS %23

    google · android15 Ara 2014

  • CVE-2014-8967
    31İzleyin

    Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted HTML document in

    OrtaCVSS 6,8İstismar yokEPSS %12

    microsoft · internet explorer15 Ara 2014

  • CVE-2014-4936
    42Planlayın

    The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.101

    KritikCVSS 9,3SilahlaştırılmışEPSS %16

    malwarebytes · malwarebytes anti-exploit16 Ara 2014

  • CVE-2014-9371
    46Planlayın

    The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON o

    KritikCVSS 10,0İstismar yokEPSS %19

    zohocorp · manageengine desktop central16 Ara 2014

  • CVE-2014-7285
    41Planlayın

    The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS co

    OrtaCVSS 6,5SilahlaştırılmışEPSS %50

    symantec · web gateway17 Ara 2014

  • CVE-2014-3580
    23İzleyin

    The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a

    OrtaCVSS 5,0İstismar yokEPSS %11

    apache · subversion18 Ara 2014

  • CVE-2014-8108
    23İzleyin

    The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause

    OrtaCVSS 5,0İstismar yokEPSS %10

    apache · subversion18 Ara 2014

  • CVE-2014-8272
    26İzleyin

    The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly se

    OrtaCVSS 5,0Kavram kanıtıEPSS %19

    dell · idrac6 modular19 Ara 2014

  • CVE-2014-6395
    34İzleyin

    Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attacke

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    ettercap-project · ettercap19 Ara 2014

  • CVE-2014-9293
    34İzleyin

    The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easi

    YüksekCVSS 7,5İstismar yokEPSS %12

    ntp · ntp19 Ara 2014

  • CVE-2014-9294
    34İzleyin

    util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptogra

    YüksekCVSS 7,5İstismar yokEPSS %12

    ntp · ntp19 Ara 2014

  • CVE-2014-9295
    54Planlayın

    Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, rel

    YüksekCVSS 7,5Kavram kanıtıEPSS %79

    ntp · ntp19 Ara 2014

  • CVE-2014-9296
    25İzleyin

    The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which m

    OrtaCVSS 5,0İstismar yokEPSS %16

    ntp · ntp19 Ara 2014

  • CVE-2014-8142
    46Planlayın

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.

    YüksekCVSS 7,5Kavram kanıtıEPSS %53

    php · php20 Ara 2014

  • CVE-2014-5208
    40Planlayın

    BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5

    YüksekCVSS 7,5SilahlaştırılmışEPSS %22

    yokogawa · exaopc22 Ara 2014

  • CVE-2014-3569
    26İzleyin

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupporte

    OrtaCVSS 5,0İstismar yokEPSS %19

    openssl · openssl24 Ara 2014

  • CVE-2014-8137
    31İzleyin

    Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of

    OrtaCVSS 6,8İstismar yokEPSS %14

    jasper project · jasper24 Ara 2014

  • CVE-2014-8138
    36İzleyin

    Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cr

    YüksekCVSS 7,5İstismar yokEPSS %18

    redhat · enterprise linux24 Ara 2014

  • CVE-2014-9222
    59Planlayın

    AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to ga

    KritikCVSS 10,0SilahlaştırılmışEPSS %63

    allegrosoft · rompager24 Ara 2014

  • CVE-2011-4722
    48Planlayın

    Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a

    YüksekCVSS 7,8SilahlaştırılmışEPSS %58

    ipswitch · tftp server27 Ara 2014

  • CVE-2014-8109
    24İzleyin

    mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which th

    OrtaCVSS 4,3İstismar yokEPSS %22

    apache · http server29 Ara 2014

  • CVE-2014-9119
    25İzleyin

    Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbi

    OrtaCVSS 5,0Kavram kanıtıEPSS %15

    db backup project · db backup31 Ara 2014