İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2015: sömürülen ve yeni ciddi CVE kayıtları

43 kayıt · 4 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2014-9456
    43Planlayın

    Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XM

    KritikCVSS 10,0Kavram kanıtıEPSS %10

    don ho · notepad\+\+2 Oca 2015

  • CVE-2014-9427
    35İzleyin

    sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .

    YüksekCVSS 7,5İstismar yokEPSS %18

    php · php2 Oca 2015

  • CVE-2013-2131
    23İzleyin

    Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial

    OrtaCVSS 5,0Kavram kanıtıEPSS %10

    rrdtool project · rrdtool4 Oca 2015

  • CVE-2014-9567
    43Planlayın

    Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to exe

    YüksekCVSS 7,5SilahlaştırılmışEPSS %43

    projectsend · projectsend7 Oca 2015

  • CVE-2014-9473
    34İzleyin

    Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to e

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    deliciousdays · cformsii7 Oca 2015

  • CVE-2014-9583
    64Bu hafta

    common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and ot

    KritikCVSS 10,0SilahlaştırılmışEPSS %80

    asus · wrt firmware8 Oca 2015

  • CVE-2014-3570
    27İzleyin

    The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of

    OrtaCVSS 5,0Kavram kanıtıEPSS %21

    openssl · openssl8 Oca 2015

  • CVE-2014-3571
    27İzleyin

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dere

    OrtaCVSS 5,0İstismar yokEPSS %22

    openssl · openssl8 Oca 2015

  • CVE-2014-8275
    25İzleyin

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows

    OrtaCVSS 5,0Kavram kanıtıEPSS %15

    openssl · openssl8 Oca 2015

  • CVE-2015-0205
    27İzleyin

    The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a D

    OrtaCVSS 5,0Kavram kanıtıEPSS %22

    openssl · openssl8 Oca 2015

  • CVE-2015-0206
    37İzleyin

    Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers t

    OrtaCVSS 5,0İstismar yokEPSS %57

    openssl · openssl8 Oca 2015

  • CVE-2015-0204
    47Planlayın

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL se

    OrtaCVSS 4,3Kavram kanıtıEPSS %98

    openssl · openssl9 Oca 2015

  • CVE-2015-0921
    40Planlayın

    XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows

    OrtaCVSS 4,0SilahlaştırılmışEPSS %17

    mcafee · epolicy orchestrator9 Oca 2015

  • CVE-2015-0922
    40Planlayın

    McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, whic

    OrtaCVSS 5,0SilahlaştırılmışEPSS %13

    mcafee · epolicy orchestrator9 Oca 2015

  • CVE-2014-100002
    40Planlayın

    Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a .

    OrtaCVSS 5,0SilahlaştırılmışEPSS %59

    zohocorp · manageengine supportcenter plus13 Oca 2015

  • CVE-2014-100005
    75Bu hafta

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev.

    YüksekCVSS 8,0KEVSilahlaştırılmışEPSS %43

    dlink · dir-600 firmware13 Oca 2015

  • CVE-2014-10011
    33İzleyin

    Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allo

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    trendnet · tv-ip422w13 Oca 2015

  • CVE-2014-10021
    48Planlayın

    Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execut

    YüksekCVSS 7,5SilahlaştırılmışEPSS %58

    wpsymposiumpro · wp symposium13 Oca 2015

  • CVE-2014-100015
    42Planlayın

    Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files vi

    OrtaCVSS 6,4SilahlaştırılmışEPSS %57

    solidworks · product data management13 Oca 2015

  • CVE-2014-10037
    36İzleyin

    Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a ..

    YüksekCVSS 7,5Kavram kanıtıEPSS %18

    domphp · domphp13 Oca 2015

  • CVE-2015-0002
    40Planlayın

    The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008

    YüksekCVSS 7,2SilahlaştırılmışEPSS %13

    microsoft · windows 713 Oca 2015

  • CVE-2015-0006
    27İzleyin

    The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wi

    OrtaCVSS 6,1Kavram kanıtıEPSS %11

    microsoft · windows 713 Oca 2015

  • CVE-2015-0014
    69Bu hafta

    Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7

    KritikCVSS 10,0İstismar yokEPSS %96

    microsoft · windows 713 Oca 2015

  • CVE-2015-0015
    55Planlayın

    Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of servi

    YüksekCVSS 7,8İstismar yokEPSS %78

    microsoft · windows server 200313 Oca 2015

  • CVE-2015-0016
    84Hemen

    Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %75

    microsoft · windows 713 Oca 2015

  • CVE-2014-8636
    49Planlayın

    The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that ha

    YüksekCVSS 7,5SilahlaştırılmışEPSS %64

    mozilla · firefox14 Oca 2015

  • CVE-2014-9308
    41Planlayın

    Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart

    OrtaCVSS 6,5SilahlaştırılmışEPSS %50

    wpeasycart · wp easycart15 Oca 2015

  • CVE-2014-9195
    54Planlayın

    Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function

    YüksekCVSS 7,5SilahlaştırılmışEPSS %80

    phoenixcontact-software · multiprog16 Oca 2015

  • CVE-2014-6593
    40Planlayın

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allow

    OrtaCVSS 4,0SilahlaştırılmışEPSS %66

    oracle · jrockit21 Oca 2015

  • CVE-2015-0382
    20İzleyin

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability vi

    OrtaCVSS 4,3İstismar yokEPSS %10

    oracle · communications policy management21 Oca 2015

  • CVE-2015-0554
    49Planlayın

    The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the w

    KritikCVSS 9,4Kavram kanıtıEPSS %38

    adb · p.dga4001n firmware21 Oca 2015

  • CVE-2015-0925
    52Planlayın

    The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a

    KritikCVSS 9,0SilahlaştırılmışEPSS %52

    ipass · ipass open mobile22 Oca 2015

  • CVE-2015-0310
    66Bu hafta

    Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not p

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %15

    adobe · flash player23 Oca 2015

  • CVE-2015-0311
    95Hemen

    Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and throu

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %85

    adobe · flash player23 Oca 2015

  • CVE-2014-8157
    35İzleyin

    Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cra

    YüksekCVSS 7,5İstismar yokEPSS %16

    opensuse · opensuse26 Oca 2015

  • CVE-2014-8158
    31İzleyin

    Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash

    OrtaCVSS 6,8İstismar yokEPSS %14

    jasper project · jasper26 Oca 2015

  • CVE-2015-0231
    43Planlayın

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.

    YüksekCVSS 7,5Kavram kanıtıEPSS %42

    php · php27 Oca 2015

  • CVE-2015-0232
    32İzleyin

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attacke

    OrtaCVSS 6,8İstismar yokEPSS %16

    php · php27 Oca 2015

  • CVE-2015-1365
    24İzleyin

    Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to wri

    OrtaCVSS 5,0Kavram kanıtıEPSS %13

    pixabay images project · pixabay images27 Oca 2015

  • CVE-2015-1375
    34İzleyin

    pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, whic

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    pixabay images project · pixabay images28 Oca 2015

  • CVE-2015-1376
    40Planlayın

    pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated user

    OrtaCVSS 4,0SilahlaştırılmışEPSS %33

    pixabay images project · pixabay images28 Oca 2015

  • CVE-2015-0235
    68Bu hafta

    Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-depen

    KritikCVSS 10,0SilahlaştırılmışEPSS %94

    gnu · glibc28 Oca 2015

  • CVE-2014-4492
    36İzleyin

    libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expe

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    apple · iphone os30 Oca 2015