İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2015: sömürülen ve yeni ciddi CVE kayıtları

48 kayıt · 7 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2015-0802
    40Planlayın

    Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, whic

    OrtaCVSS 5,0SilahlaştırılmışEPSS %67

    mozilla · firefox1 Nis 2015

  • CVE-2015-0816
    40Planlayın

    Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes

    OrtaCVSS 5,0SilahlaştırılmışEPSS %66

    mozilla · firefox1 Nis 2015

  • CVE-2015-2294
    24İzleyin

    Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web scr

    OrtaCVSS 4,3İstismar yokEPSS %24

    netgate · pfsense1 Nis 2015

  • CVE-2015-0666
    72Bu hafta

    Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote atta

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %40

    cisco · prime data center network manager3 Nis 2015

  • CVE-2015-2166
    28İzleyin

    Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remot

    OrtaCVSS 5,0Kavram kanıtıEPSS %26

    ericsson · drutt mobile service delivery platform6 Nis 2015

  • CVE-2015-0248
    24İzleyin

    The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a d

    OrtaCVSS 5,0İstismar yokEPSS %12

    apache · subversion8 Nis 2015

  • CVE-2015-1126
    40Planlayın

    WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the

    OrtaCVSS 4,3SilahlaştırılmışEPSS %9

    apple · iphone os10 Nis 2015

  • CVE-2015-1130
    64Bu hafta

    The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileg

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %9

    apple · mac os x10 Nis 2015

  • CVE-2015-2295
    47Planlayın

    Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote

    OrtaCVSS 6,8Kavram kanıtıEPSS %65

    netgate · pfsense10 Nis 2015

  • CVE-2015-3008
    31İzleyin

    Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 befo

    OrtaCVSS 4,3İstismar yokEPSS %46

    digium · asterisk10 Nis 2015

  • CVE-2015-1635
    99Hemen

    HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote a

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    microsoft · windows 714 Nis 2015

  • CVE-2015-1638
    27İzleyin

    Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows r

    OrtaCVSS 5,8İstismar yokEPSS %12

    microsoft · windows server 201214 Nis 2015

  • CVE-2015-1641
    90Hemen

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3,

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %97

    microsoft · office14 Nis 2015

  • CVE-2015-1645
    45Planlayın

    Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execut

    KritikCVSS 9,3İstismar yokEPSS %25

    microsoft · windows 714 Nis 2015

  • CVE-2015-1646
    22İzleyin

    Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a

    OrtaCVSS 4,3İstismar yokEPSS %16

    microsoft · xml core services14 Nis 2015

  • CVE-2015-1648
    20İzleyin

    ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled,

    DüşükCVSS 2,6İstismar yokEPSS %34

    microsoft · .net framework14 Nis 2015

  • CVE-2015-1649
    45Planlayın

    Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Au

    KritikCVSS 9,3İstismar yokEPSS %25

    microsoft · office14 Nis 2015

  • CVE-2015-1650
    46Planlayın

    Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Offic

    KritikCVSS 9,3İstismar yokEPSS %28

    microsoft · office14 Nis 2015

  • CVE-2015-1651
    42Planlayın

    Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute a

    KritikCVSS 9,3İstismar yokEPSS %16

    microsoft · office compatibility pack14 Nis 2015

  • CVE-2015-1652
    42Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1657
    41Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1659
    42Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1660
    41Planlayın

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1661
    21İzleyin

    Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern

    OrtaCVSS 4,3İstismar yokEPSS %14

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1662
    41Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1665
    42Planlayın

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1666
    41Planlayın

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1667
    41Planlayın

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-1668
    42Planlayın

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    KritikCVSS 9,3İstismar yokEPSS %15

    microsoft · internet explorer14 Nis 2015

  • CVE-2015-0346
    43Planlayın

    Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.

    KritikCVSS 10,0İstismar yokEPSS %10

    adobe · flash player14 Nis 2015

  • CVE-2015-0358
    43Planlayın

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before

    KritikCVSS 10,0İstismar yokEPSS %10

    adobe · flash player14 Nis 2015

  • CVE-2015-0359
    68Bu hafta

    Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.

    KritikCVSS 10,0SilahlaştırılmışEPSS %92

    adobe · flash player14 Nis 2015

  • CVE-2015-3042
    51Planlayın

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att

    KritikCVSS 10,0Kavram kanıtıEPSS %36

    adobe · flash player14 Nis 2015

  • CVE-2015-3043
    91Hemen

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %73

    adobe · flash player14 Nis 2015

  • CVE-2015-0501
    25İzleyin

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect ava

    OrtaCVSS 5,7İstismar yokEPSS %10

    oracle · mysql16 Nis 2015

  • CVE-2015-1318
    40Planlayın

    The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport

    YüksekCVSS 7,2SilahlaştırılmışEPSS %4

    apport project · apport17 Nis 2015

  • CVE-2015-0969
    24İzleyin

    SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.

    OrtaCVSS 5,0İstismar yokEPSS %13

    searchblox · searchblox17 Nis 2015

  • CVE-2015-1701
    78Bu hafta

    Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privil

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %55

    microsoft · windows 2003 server21 Nis 2015

  • CVE-2015-2825
    34İzleyin

    Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote atta

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    simple ads manager project · simple ads manager21 Nis 2015

  • CVE-2015-0135
    52Planlayın

    IBM Domino 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 allows remote attackers to execute arbitrary code or cause a denial of serv

    KritikCVSS 10,0İstismar yokEPSS %39

    ibm · domino21 Nis 2015

  • CVE-2015-3035
    85Hemen

    Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %83

    tp-link · tl-wr741nd firmware21 Nis 2015

  • CVE-2015-3143
    23İzleyin

    cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users vi

    OrtaCVSS 5,0İstismar yokEPSS %11

    haxx · curl24 Nis 2015

  • CVE-2015-3144
    39İzleyin

    The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to c

    KritikCVSS 9,0İstismar yokEPSS %10

    oracle · mysql enterprise monitor24 Nis 2015

  • CVE-2015-3145
    39İzleyin

    The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attack

    YüksekCVSS 7,5İstismar yokEPSS %30

    fedoraproject · fedora24 Nis 2015

  • CVE-2015-3148
    24İzleyin

    cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect

    OrtaCVSS 5,0İstismar yokEPSS %14

    fedoraproject · fedora24 Nis 2015

  • CVE-2015-1397
    43Planlayın

    SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1

    OrtaCVSS 6,5Kavram kanıtıEPSS %55

    magento · magento29 Nis 2015

  • CVE-2015-1398
    30İzleyin

    Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote aut

    OrtaCVSS 6,5İstismar yokEPSS %13

    magento · magento29 Nis 2015

  • CVE-2015-3457
    28İzleyin

    Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarde

    OrtaCVSS 5,0İstismar yokEPSS %25

    magento · magento29 Nis 2015