İçeriğe atla
Noroxi

Yayın tarihine göre

Şubat 2016: sömürülen ve yeni ciddi CVE kayıtları

65 kayıt · 5 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-0861
    39İzleyin

    General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    ge · ups snmp web adapter firmware5 Şub 2016

  • CVE-2016-0801
    49Planlayın

    The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attack

    KritikCVSS 9,8Kavram kanıtıEPSS %33

    apple · iphone os6 Şub 2016

  • CVE-2016-0022
    37İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · office compatibility pack10 Şub 2016

  • CVE-2016-0033
    35İzleyin

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows

    YüksekCVSS 7,5İstismar yokEPSS %17

    microsoft · .net framework10 Şub 2016

  • CVE-2016-0036
    35İzleyin

    The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 al

    YüksekCVSS 8,1İstismar yokEPSS %11

    microsoft · windows 1010 Şub 2016

  • CVE-2016-0037
    38İzleyin

    The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows

    YüksekCVSS 7,5İstismar yokEPSS %25

    microsoft · windows server 201210 Şub 2016

  • CVE-2016-0038
    37İzleyin

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · windows 1010 Şub 2016

  • CVE-2016-0040
    68Bu hafta

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %24

    microsoft · windows 710 Şub 2016

  • CVE-2016-0041
    56Planlayın

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1

    YüksekCVSS 7,8SilahlaştırılmışEPSS %82

    microsoft · internet explorer10 Şub 2016

  • CVE-2016-0044
    34İzleyin

    Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (Sy

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · windows 8.110 Şub 2016

  • CVE-2016-0046
    39İzleyin

    Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code v

    YüksekCVSS 7,8İstismar yokEPSS %26

    microsoft · windows 1010 Şub 2016

  • CVE-2016-0047
    36İzleyin

    WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from

    YüksekCVSS 7,5İstismar yokEPSS %20

    microsoft · .net framework10 Şub 2016

  • CVE-2016-0049
    28İzleyin

    Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, an

    OrtaCVSS 6,2Kavram kanıtıEPSS %13

    microsoft · windows 1010 Şub 2016

  • CVE-2016-0050
    26İzleyin

    Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which al

    OrtaCVSS 5,3İstismar yokEPSS %17

    microsoft · windows server 200810 Şub 2016

  • CVE-2016-0051
    40Planlayın

    The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a

    YüksekCVSS 7,8SilahlaştırılmışEPSS %22

    microsoft · windows 1010 Şub 2016

  • CVE-2016-0052
    37İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · office10 Şub 2016

  • CVE-2016-0053
    37İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Vie

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · office10 Şub 2016

  • CVE-2016-0054
    36İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp

    YüksekCVSS 7,8İstismar yokEPSS %15

    microsoft · excel10 Şub 2016

  • CVE-2016-0056
    36İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · office10 Şub 2016

  • CVE-2016-0058
    38İzleyin

    Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to exec

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · windows 1010 Şub 2016

  • CVE-2016-0059
    24İzleyin

    The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from proces

    OrtaCVSS 4,3İstismar yokEPSS %23

    microsoft · internet explorer10 Şub 2016

  • CVE-2016-0060
    43Planlayın

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 8,8İstismar yokEPSS %26

    microsoft · edge10 Şub 2016

  • CVE-2016-0061
    41Planlayın

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 8,8İstismar yokEPSS %20

    microsoft · edge10 Şub 2016

  • CVE-2016-0062
    41Planlayın

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr

    YüksekCVSS 8,8İstismar yokEPSS %20

    microsoft · edge10 Şub 2016

  • CVE-2016-0063
    47Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8Kavram kanıtıEPSS %38

    microsoft · internet explorer10 Şub 2016

  • CVE-2016-0064
    39İzleyin

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    YüksekCVSS 8,8İstismar yokEPSS %13

    microsoft · internet explorer10 Şub 2016

  • CVE-2016-0067
    39İzleyin

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8İstismar yokEPSS %13

    microsoft · internet explorer10 Şub 2016

  • CVE-2016-0071
    39İzleyin

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    YüksekCVSS 8,8İstismar yokEPSS %13

    microsoft · internet explorer10 Şub 2016

  • CVE-2016-0072
    41Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8İstismar yokEPSS %19

    microsoft · internet explorer10 Şub 2016

  • CVE-2016-0080
    21İzleyin

    Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection

    OrtaCVSS 4,3İstismar yokEPSS %14

    microsoft · edge10 Şub 2016

  • CVE-2016-0084
    40Planlayın

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 8,8İstismar yokEPSS %17

    microsoft · edge10 Şub 2016

  • CVE-2016-0055
    36İzleyin

    Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corr

    YüksekCVSS 7,8İstismar yokEPSS %15

    microsoft · office10 Şub 2016

  • CVE-2016-0951
    45Planlayın

    Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    adobe · bridge cc10 Şub 2016

  • CVE-2016-0952
    45Planlayın

    Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    adobe · bridge cc10 Şub 2016

  • CVE-2016-0953
    45Planlayın

    Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    adobe · bridge cc10 Şub 2016

  • CVE-2016-0956
    45Planlayın

    The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to o

    YüksekCVSS 7,5Kavram kanıtıEPSS %51

    apache · sling10 Şub 2016

  • CVE-2016-0957
    46Planlayın

    Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote at

    YüksekCVSS 7,5Kavram kanıtıEPSS %51

    adobe · dispatcher10 Şub 2016

  • CVE-2016-0964
    41Planlayın

    Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    adobe · flash player10 Şub 2016

  • CVE-2016-0965
    41Planlayın

    Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    adobe · flash player10 Şub 2016

  • CVE-2016-0967
    41Planlayın

    Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    adobe · flash player10 Şub 2016

  • CVE-2016-0971
    45Planlayın

    Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.2

    YüksekCVSS 8,8Kavram kanıtıEPSS %33

    adobe · flash player10 Şub 2016

  • CVE-2016-0974
    44Planlayın

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2

    YüksekCVSS 8,8Kavram kanıtıEPSS %30

    adobe · flash player10 Şub 2016

  • CVE-2016-0984
    81Hemen

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %54

    adobe · flash player10 Şub 2016

  • CVE-2016-0985
    43Planlayın

    Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef

    YüksekCVSS 8,8Kavram kanıtıEPSS %26

    adobe · flash player10 Şub 2016

  • CVE-2016-1287
    61Bu hafta

    Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9

    KritikCVSS 9,8Kavram kanıtıEPSS %74

    cisco · adaptive security appliance software11 Şub 2016

  • CVE-2016-1524
    66Bu hafta

    Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute

    KritikCVSS 9,6SilahlaştırılmışEPSS %94

    netgear · prosafe network management software 30012 Şub 2016

  • CVE-2016-1525
    60Bu hafta

    Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticat

    YüksekCVSS 8,6SilahlaştırılmışEPSS %75

    netgear · prosafe network management software 30012 Şub 2016

  • CVE-2015-3197
    26İzleyin

    ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man

    OrtaCVSS 5,9Kavram kanıtıEPSS %10

    openssl · openssl14 Şub 2016

  • CVE-2016-0701
    39İzleyin

    The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for

    DüşükCVSS 3,7İstismar yokEPSS %83

    openssl · openssl14 Şub 2016

  • CVE-2016-0742
    55Planlayın

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference

    YüksekCVSS 7,5İstismar yokEPSS %82

    f5 · nginx15 Şub 2016

  • CVE-2016-0752
    89Hemen

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %95

    rubyonrails · rails15 Şub 2016

  • CVE-2016-2386
    90Hemen

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %71

    sap · netweaver application server java16 Şub 2016

  • CVE-2016-2388
    67Bu hafta

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %52

    sap · netweaver application server java16 Şub 2016

  • CVE-2016-2389
    42Planlayın

    Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 fo

    YüksekCVSS 7,5Kavram kanıtıEPSS %41

    sap · netweaver16 Şub 2016

  • CVE-2015-7547
    59Planlayın

    Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc

    YüksekCVSS 8,1Kavram kanıtıEPSS %90

    gnu · glibc18 Şub 2016

  • CVE-2016-0068
    39İzleyin

    Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Exp

    YüksekCVSS 8,8İstismar yokEPSS %14

    microsoft · internet explorer18 Şub 2016

  • CVE-2016-0069
    41Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Exp

    YüksekCVSS 8,8İstismar yokEPSS %18

    microsoft · internet explorer18 Şub 2016

  • CVE-2015-8277
    48Planlayın

    Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote at

    KritikCVSS 9,8Kavram kanıtıEPSS %28

    flexerasoftware · flexnet publisher23 Şub 2016

  • CVE-2015-5174
    21İzleyin

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows re

    OrtaCVSS 4,3İstismar yokEPSS %12

    apache · tomcat25 Şub 2016

  • CVE-2015-5345
    27İzleyin

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects b

    OrtaCVSS 5,3İstismar yokEPSS %18

    apache · tomcat25 Şub 2016

  • CVE-2015-5346
    35İzleyin

    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settin

    YüksekCVSS 8,1İstismar yokEPSS %10

    apache · tomcat25 Şub 2016

  • CVE-2016-0714
    39İzleyin

    The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mis

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    apache · tomcat25 Şub 2016

  • CVE-2016-0763
    28İzleyin

    The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and

    OrtaCVSS 6,3İstismar yokEPSS %11

    apache · tomcat25 Şub 2016

  • CVE-2016-2569
    39İzleyin

    Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial

    YüksekCVSS 7,5Kavram kanıtıEPSS %31

    squid-cache · squid27 Şub 2016

  • CVE-2016-2572
    33İzleyin

    http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause

    YüksekCVSS 7,5İstismar yokEPSS %10

    squid-cache · squid27 Şub 2016