İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2016: sömürülen ve yeni ciddi CVE kayıtları

76 kayıt · 8 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-0793
    34İzleyin

    Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    redhat · jboss wildfly application server1 Nis 2016

  • CVE-2016-1019
    76Bu hafta

    Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbit

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %22

    adobe · flash player desktop runtime7 Nis 2016

  • CVE-2016-3947
    36İzleyin

    Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 al

    YüksekCVSS 8,2İstismar yokEPSS %14

    squid-cache · squid7 Nis 2016

  • CVE-2016-3948
    41Planlayın

    Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service

    YüksekCVSS 7,5İstismar yokEPSS %35

    squid-cache · squid7 Nis 2016

  • CVE-2016-3974
    41Planlayın

    XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to caus

    KritikCVSS 9,1Kavram kanıtıEPSS %15

    sap · netweaver application server java7 Nis 2016

  • CVE-2016-2510
    53Planlayın

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attack

    YüksekCVSS 8,1İstismar yokEPSS %70

    beanshell · beanshell7 Nis 2016

  • CVE-2016-0788
    43Planlayın

    The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP liste

    KritikCVSS 9,8İstismar yokEPSS %11

    jenkins · jenkins7 Nis 2016

  • CVE-2016-0792
    60Bu hafta

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code

    YüksekCVSS 8,8SilahlaştırılmışEPSS %83

    jenkins · jenkins7 Nis 2016

  • CVE-2016-1531
    40Planlayın

    Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

    YüksekCVSS 7,0SilahlaştırılmışEPSS %6

    exim · exim7 Nis 2016

  • CVE-2016-2098
    60Bu hafta

    Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rub

    YüksekCVSS 7,3SilahlaştırılmışEPSS %81

    debian · debian linux7 Nis 2016

  • CVE-2016-2563
    49Planlayın

    Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cau

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    9bis · kitty7 Nis 2016

  • CVE-2016-2851
    47Planlayın

    Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corrupti

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    debian · debian linux7 Nis 2016

  • CVE-2016-3976
    74Bu hafta

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot do

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %47

    sap · netweaver application server java7 Nis 2016

  • CVE-2016-2315
    44Planlayın

    revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long f

    KritikCVSS 9,8İstismar yokEPSS %17

    suse · linux enterprise debuginfo8 Nis 2016

  • CVE-2016-2324
    44Planlayın

    Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, whi

    KritikCVSS 9,8İstismar yokEPSS %18

    suse · linux enterprise debuginfo8 Nis 2016

  • CVE-2016-1011
    43Planlayın

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before

    YüksekCVSS 8,8Kavram kanıtıEPSS %26

    adobe · flash player8 Nis 2016

  • CVE-2016-1013
    42Planlayın

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before

    YüksekCVSS 8,8Kavram kanıtıEPSS %22

    adobe · flash player8 Nis 2016

  • CVE-2016-0709
    51Planlayın

    Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote aut

    YüksekCVSS 7,2SilahlaştırılmışEPSS %77

    apache · jetspeed11 Nis 2016

  • CVE-2016-0710
    51Planlayın

    Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitra

    YüksekCVSS 8,8SilahlaştırılmışEPSS %52

    apache · jetspeed11 Nis 2016

  • CVE-2016-0784
    43Planlayın

    Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authen

    OrtaCVSS 6,5Kavram kanıtıEPSS %56

    apache · openmeetings11 Nis 2016

  • CVE-2016-2171
    43Planlayın

    The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote atta

    YüksekCVSS 7,5İstismar yokEPSS %42

    apache · jetspeed11 Nis 2016

  • CVE-2016-2385
    48Planlayın

    Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5

    KritikCVSS 9,8Kavram kanıtıEPSS %30

    kamailio · kamailio11 Nis 2016

  • CVE-2015-8399
    35İzleyin

    Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spac

    OrtaCVSS 4,3Kavram kanıtıEPSS %60

    atlassian · confluence11 Nis 2016

  • CVE-2016-3987
    46Planlayın

    The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/ope

    KritikCVSS 9,8Kavram kanıtıEPSS %22

    trendmicro · password manager11 Nis 2016

  • CVE-2016-2170
    43Planlayın

    Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serializ

    KritikCVSS 9,8İstismar yokEPSS %12

    apache · ofbiz12 Nis 2016

  • CVE-2016-4003
    27İzleyin

    Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when usin

    OrtaCVSS 6,1İstismar yokEPSS %11

    apache · struts12 Nis 2016

  • CVE-2016-0122
    43Planlayın

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, a

    YüksekCVSS 7,8Kavram kanıtıEPSS %41

    microsoft · excel12 Nis 2016

  • CVE-2016-0127
    37İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word A

    YüksekCVSS 7,8İstismar yokEPSS %21

    microsoft · office12 Nis 2016

  • CVE-2016-0128
    33İzleyin

    The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Wi

    OrtaCVSS 6,8İstismar yokEPSS %20

    microsoft · windows 1012 Nis 2016

  • CVE-2016-0136
    37İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, and Excel Services on

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · excel12 Nis 2016

  • CVE-2016-0139
    36İzleyin

    Microsoft Excel 2010 SP2, Word for Mac 2011, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · excel12 Nis 2016

  • CVE-2016-0145
    48Planlayın

    The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an

    YüksekCVSS 8,8Kavram kanıtıEPSS %43

    microsoft · .net framework12 Nis 2016

  • CVE-2016-0147
    40Planlayın

    Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Executi

    YüksekCVSS 8,8İstismar yokEPSS %15

    microsoft · xml core services12 Nis 2016

  • CVE-2016-0148
    35İzleyin

    Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to gain privileges via a crafted application, ak

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · .net framework12 Nis 2016

  • CVE-2016-0150
    39İzleyin

    HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0 reque

    YüksekCVSS 7,5İstismar yokEPSS %28

    microsoft · windows 1012 Nis 2016

  • CVE-2016-0151
    80Hemen

    The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %62

    microsoft · windows 10 150712 Nis 2016

  • CVE-2016-0153
    37İzleyin

    OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Win

    YüksekCVSS 7,8İstismar yokEPSS %21

    microsoft · windows 712 Nis 2016

  • CVE-2016-0154
    34İzleyin

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge12 Nis 2016

  • CVE-2016-0155
    33İzleyin

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · edge12 Nis 2016

  • CVE-2016-0156
    36İzleyin

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 7,5İstismar yokEPSS %19

    microsoft · edge12 Nis 2016

  • CVE-2016-0157
    35İzleyin

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge12 Nis 2016

  • CVE-2016-0158
    31İzleyin

    Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege

    OrtaCVSS 6,5İstismar yokEPSS %15

    microsoft · edge12 Nis 2016

  • CVE-2016-0159
    35İzleyin

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · internet explorer12 Nis 2016

  • CVE-2016-0160
    35İzleyin

    Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loadi

    YüksekCVSS 7,8İstismar yokEPSS %12

    microsoft · internet explorer12 Nis 2016

  • CVE-2016-0161
    47Planlayın

    Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege

    OrtaCVSS 6,5İstismar yokEPSS %68

    microsoft · edge12 Nis 2016

  • CVE-2016-0162
    60Bu hafta

    Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Inter

    OrtaCVSS 4,3KEVSilahlaştırılmışEPSS %22

    microsoft · internet explorer12 Nis 2016

  • CVE-2016-0164
    34İzleyin

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · internet explorer12 Nis 2016

  • CVE-2016-0165
    65Bu hafta

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %13

    microsoft · windows 10 150712 Nis 2016

  • CVE-2016-0166
    35İzleyin

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · internet explorer12 Nis 2016

  • CVE-2016-0167
    63Bu hafta

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %5

    microsoft · windows 10 150712 Nis 2016

  • CVE-2016-2118
    41Planlayın

    The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DC

    YüksekCVSS 7,5Kavram kanıtıEPSS %36

    samba · samba12 Nis 2016

  • CVE-2015-7545
    45Planlayın

    The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    git project · git13 Nis 2016

  • CVE-2016-2055
    60Bu hafta

    xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration

    YüksekCVSS 7,5SilahlaştırılmışEPSS %17

    xymon · xymon13 Nis 2016

  • CVE-2016-2056
    51Planlayın

    xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacter

    YüksekCVSS 8,8SilahlaştırılmışEPSS %54

    xymon · xymon13 Nis 2016

  • CVE-2015-5343
    39İzleyin

    Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticate

    YüksekCVSS 7,6İstismar yokEPSS %30

    apache · subversion14 Nis 2016

  • CVE-2016-2390
    31İzleyin

    The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake err

    OrtaCVSS 5,9İstismar yokEPSS %25

    squid-cache · squid19 Nis 2016

  • CVE-2016-0638
    58Planlayın

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remo

    KritikCVSS 9,8Kavram kanıtıEPSS %62

    oracle · weblogic server21 Nis 2016

  • CVE-2016-0639
    42Planlayın

    Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integ

    KritikCVSS 9,8İstismar yokEPSS %10

    oracle · mysql21 Nis 2016

  • CVE-2016-2004
    67Bu hafta

    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified ve

    KritikCVSS 9,8SilahlaştırılmışEPSS %94

    hp · data protector21 Nis 2016

  • CVE-2016-2005
    45Planlayın

    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified v

    KritikCVSS 9,8İstismar yokEPSS %20

    hp · data protector21 Nis 2016

  • CVE-2016-2006
    45Planlayın

    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified v

    KritikCVSS 9,8İstismar yokEPSS %20

    hp · data protector21 Nis 2016

  • CVE-2016-2007
    45Planlayın

    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified v

    KritikCVSS 9,8İstismar yokEPSS %20

    hp · data protector21 Nis 2016

  • CVE-2016-2008
    42Planlayın

    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified v

    KritikCVSS 9,8İstismar yokEPSS %10

    hp · data protector21 Nis 2016

  • CVE-2016-3427
    97Hemen

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to aff

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %92

    oracle · jdk21 Nis 2016

  • CVE-2016-1593
    47Planlayın

    Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated admi

    YüksekCVSS 7,2SilahlaştırılmışEPSS %64

    novell · service desk22 Nis 2016

  • CVE-2016-2203
    40Planlayın

    The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD pa

    YüksekCVSS 7,8SilahlaştırılmışEPSS %7

    symantec · messaging gateway22 Nis 2016

  • CVE-2015-5370
    29İzleyin

    Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remo

    OrtaCVSS 5,9İstismar yokEPSS %19

    samba · samba24 Nis 2016

  • CVE-2016-2115
    26İzleyin

    Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_

    OrtaCVSS 5,9İstismar yokEPSS %10

    samba · samba24 Nis 2016

  • CVE-2016-4051
    40Planlayın

    Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of serv

    YüksekCVSS 8,8İstismar yokEPSS %18

    canonical · ubuntu linux25 Nis 2016

  • CVE-2016-4052
    36İzleyin

    Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service

    YüksekCVSS 8,1İstismar yokEPSS %12

    canonical · ubuntu linux25 Nis 2016

  • CVE-2016-4053
    18İzleyin

    Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Inclu

    DüşükCVSS 3,7İstismar yokEPSS %14

    squid-cache · squid25 Nis 2016

  • CVE-2016-4054
    55Planlayın

    Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Incl

    YüksekCVSS 8,1İstismar yokEPSS %77

    canonical · ubuntu linux25 Nis 2016

  • CVE-2016-3074
    50Planlayın

    Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or

    KritikCVSS 9,8Kavram kanıtıEPSS %37

    libgd · libgd26 Nis 2016

  • CVE-2016-3082
    45Planlayın

    XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute a

    KritikCVSS 9,8İstismar yokEPSS %19

    apache · struts26 Nis 2016

  • CVE-2016-3081
    91Hemen

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %96

    apache · struts26 Nis 2016

  • CVE-2015-8812
    43Planlayın

    drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attack

    KritikCVSS 9,8İstismar yokEPSS %14

    linux · linux kernel27 Nis 2016