İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2015: sömürülen ve yeni ciddi CVE kayıtları

41 kayıt · 2 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2015-7709
    64Bu hafta

    The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication

    KritikCVSS 10,0SilahlaştırılmışEPSS %78

    arkeia · western digital arkeia5 Eki 2015

  • CVE-2015-5889
    40Planlayın

    rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment v

    YüksekCVSS 7,2SilahlaştırılmışEPSS %5

    apple · mac os x9 Eki 2015

  • CVE-2015-7765
    56Planlayın

    ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows

    KritikCVSS 9,0SilahlaştırılmışEPSS %67

    zohocorp · manageengine opmanager9 Eki 2015

  • CVE-2015-7766
    60Bu hafta

    PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions vi

    KritikCVSS 9,0SilahlaştırılmışEPSS %80

    zohocorp · manageengine opmanager9 Eki 2015

  • CVE-2015-7768
    49Planlayın

    Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %63

    konicaminolta · ftp utility9 Eki 2015

  • CVE-2015-2342
    67Bu hafta

    The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration

    KritikCVSS 10,0SilahlaştırılmışEPSS %89

    vmware · vcenter server12 Eki 2015

  • CVE-2015-2482
    47Planlayın

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    KritikCVSS 9,3Kavram kanıtıEPSS %32

    microsoft · jscript13 Eki 2015

  • CVE-2015-2515
    46Planlayın

    Use-after-free vulnerability in Windows Shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,

    KritikCVSS 9,3İstismar yokEPSS %28

    microsoft · windows 1013 Eki 2015

  • CVE-2015-2548
    44Planlayın

    Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attack

    KritikCVSS 9,3İstismar yokEPSS %24

    microsoft · windows 713 Eki 2015

  • CVE-2015-2555
    44Planlayın

    Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for

    KritikCVSS 9,3İstismar yokEPSS %23

    microsoft · excel13 Eki 2015

  • CVE-2015-2556
    22İzleyin

    The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to

    OrtaCVSS 4,3İstismar yokEPSS %15

    microsoft · sharepoint server13 Eki 2015

  • CVE-2015-2557
    44Planlayın

    Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · visio13 Eki 2015

  • CVE-2015-2558
    44Planlayın

    Use-after-free vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011,

    KritikCVSS 9,3İstismar yokEPSS %23

    microsoft · excel13 Eki 2015

  • CVE-2015-6042
    44Planlayın

    Use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbit

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6046
    21İzleyin

    Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site,

    OrtaCVSS 4,3İstismar yokEPSS %14

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6047
    31İzleyin

    The broker EditWith feature in Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the AppContainer protection mechan

    OrtaCVSS 6,8İstismar yokEPSS %13

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6048
    41Planlayın

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6049
    41Planlayın

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    KritikCVSS 9,3İstismar yokEPSS %14

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6050
    41Planlayın

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6051
    21İzleyin

    Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition fro

    OrtaCVSS 4,3İstismar yokEPSS %14

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6052
    21İzleyin

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    OrtaCVSS 4,3İstismar yokEPSS %14

    microsoft · jscript13 Eki 2015

  • CVE-2015-6053
    26İzleyin

    Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via crafted parameters in an Arra

    OrtaCVSS 5,0İstismar yokEPSS %18

    microsoft · internet explorer13 Eki 2015

  • CVE-2015-6055
    45Planlayın

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    KritikCVSS 9,3İstismar yokEPSS %25

    microsoft · jscript13 Eki 2015

  • CVE-2015-6056
    41Planlayın

    The (1) JScript and (2) VBScript engines in Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cau

    KritikCVSS 9,3İstismar yokEPSS %12

    microsoft · jscript13 Eki 2015

  • CVE-2015-6057
    25İzleyin

    Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Infor

    OrtaCVSS 5,0İstismar yokEPSS %15

    microsoft · edge13 Eki 2015

  • CVE-2015-6058
    38İzleyin

    Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection

    OrtaCVSS 4,3İstismar yokEPSS %69

    microsoft · edge13 Eki 2015

  • CVE-2015-6059
    22İzleyin

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    OrtaCVSS 4,3İstismar yokEPSS %16

    microsoft · jscript13 Eki 2015

  • CVE-2015-7622
    47Planlayın

    Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrob

    KritikCVSS 10,0Kavram kanıtıEPSS %23

    adobe · acrobat14 Eki 2015

  • CVE-2015-7645
    81Hemen

    Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows rem

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %65

    adobe · flash player15 Eki 2015

  • CVE-2015-7647
    49Planlayın

    Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to exe

    KritikCVSS 10,0Kavram kanıtıEPSS %29

    adobe · flash player18 Eki 2015

  • CVE-2015-7648
    49Planlayın

    Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to exe

    KritikCVSS 10,0Kavram kanıtıEPSS %29

    adobe · flash player18 Eki 2015

  • CVE-2015-6477
    28İzleyin

    Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow

    OrtaCVSS 6,1Kavram kanıtıEPSS %12

    nordex · nordex control 2 scada18 Eki 2015

  • CVE-2015-4716
    47Planlayın

    Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows,

    KritikCVSS 10,0İstismar yokEPSS %24

    owncloud · owncloud21 Eki 2015

  • CVE-2015-4796
    41Planlayın

    Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2, when running on Windows, allo

    KritikCVSS 9,0İstismar yokEPSS %17

    oracle · database server21 Eki 2015

  • CVE-2015-4870
    25İzleyin

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect ava

    OrtaCVSS 4,0Kavram kanıtıEPSS %30

    oracle · linux21 Eki 2015

  • CVE-2015-4902
    60Bu hafta

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %13

    oracle · jdk21 Eki 2015

  • CVE-2015-7007
    46Planlayın

    Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execu

    YüksekCVSS 7,5SilahlaştırılmışEPSS %53

    apple · mac os x23 Eki 2015

  • CVE-2015-5262
    23İzleyin

    http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration

    OrtaCVSS 4,3İstismar yokEPSS %18

    apache · httpclient27 Eki 2015

  • CVE-2015-7297
    60Bu hafta

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a

    YüksekCVSS 7,5SilahlaştırılmışEPSS %99

    joomla · joomla\!29 Eki 2015

  • CVE-2015-7857
    58Planlayın

    SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 be

    YüksekCVSS 7,5SilahlaştırılmışEPSS %94

    joomla · joomla\!29 Eki 2015

  • CVE-2015-7858
    56Planlayın

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a

    YüksekCVSS 7,5SilahlaştırılmışEPSS %85

    joomla · joomla\!29 Eki 2015