İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2016: sömürülen ve yeni ciddi CVE kayıtları

72 kayıt · 7 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-2105
    42Planlayın

    Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote atta

    YüksekCVSS 7,5İstismar yokEPSS %39

    openssl · openssl4 May 2016

  • CVE-2016-2106
    38İzleyin

    Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote at

    YüksekCVSS 7,5İstismar yokEPSS %27

    openssl · openssl4 May 2016

  • CVE-2016-2107
    50Planlayın

    The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding chec

    OrtaCVSS 5,9Kavram kanıtıEPSS %89

    openssl · openssl4 May 2016

  • CVE-2016-2108
    62Bu hafta

    The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denia

    KritikCVSS 9,8İstismar yokEPSS %77

    openssl · openssl4 May 2016

  • CVE-2016-2109
    39İzleyin

    The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h al

    YüksekCVSS 7,5İstismar yokEPSS %29

    openssl · openssl4 May 2016

  • CVE-2016-2176
    39İzleyin

    The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain

    YüksekCVSS 8,2İstismar yokEPSS %23

    openssl · openssl4 May 2016

  • CVE-2016-2168
    32İzleyin

    The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allo

    OrtaCVSS 6,5İstismar yokEPSS %20

    apache · subversion5 May 2016

  • CVE-2016-3714
    92Hemen

    The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x befor

    YüksekCVSS 8,4KEVSilahlaştırılmışEPSS %97

    imagemagick · imagemagick5 May 2016

  • CVE-2016-3715
    75Bu hafta

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted im

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %75

    imagemagick · imagemagick5 May 2016

  • CVE-2016-3716
    16İzleyin

    The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.

    DüşükCVSS 3,3Kavram kanıtıEPSS %11

    imagemagick · imagemagick5 May 2016

  • CVE-2016-3717
    28İzleyin

    The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.

    OrtaCVSS 5,5Kavram kanıtıEPSS %20

    imagemagick · imagemagick5 May 2016

  • CVE-2016-3718
    75Bu hafta

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %75

    imagemagick · imagemagick5 May 2016

  • CVE-2016-4008
    32İzleyin

    The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, a

    OrtaCVSS 5,9İstismar yokEPSS %29

    gnu · libtasn15 May 2016

  • CVE-2016-1541
    38İzleyin

    Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remo

    YüksekCVSS 8,8İstismar yokEPSS %10

    libarchive · libarchive7 May 2016

  • CVE-2016-4350
    60Bu hafta

    Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storag

    KritikCVSS 9,8İstismar yokEPSS %70

    solarwinds · storage resource monitor9 May 2016

  • CVE-2016-4553
    58Planlayın

    client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which al

    YüksekCVSS 8,6İstismar yokEPSS %79

    canonical · ubuntu linux10 May 2016

  • CVE-2016-4554
    46Planlayın

    mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoni

    YüksekCVSS 8,6İstismar yokEPSS %38

    oracle · linux10 May 2016

  • CVE-2016-4555
    35İzleyin

    client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via craft

    YüksekCVSS 7,5İstismar yokEPSS %18

    squid-cache · squid10 May 2016

  • CVE-2016-4556
    37İzleyin

    Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (cra

    YüksekCVSS 7,5İstismar yokEPSS %23

    squid-cache · squid10 May 2016

  • CVE-2016-0126
    37İzleyin

    Microsoft Office 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Micro

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · office10 May 2016

  • CVE-2016-0140
    37İzleyin

    Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remot

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · office10 May 2016

  • CVE-2016-0168
    39İzleyin

    GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows

    OrtaCVSS 6,5Kavram kanıtıEPSS %43

    microsoft · windows 1010 May 2016

  • CVE-2016-0169
    39İzleyin

    GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows

    OrtaCVSS 6,5Kavram kanıtıEPSS %43

    microsoft · windows 1010 May 2016

  • CVE-2016-0170
    50Planlayın

    GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows

    YüksekCVSS 8,8Kavram kanıtıEPSS %48

    microsoft · windows 1010 May 2016

  • CVE-2016-0178
    40Planlayın

    The RPC NDR Engine in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold

    YüksekCVSS 8,8İstismar yokEPSS %16

    microsoft · windows 1010 May 2016

  • CVE-2016-0179
    38İzleyin

    Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to exec

    YüksekCVSS 7,8İstismar yokEPSS %24

    microsoft · windows 1010 May 2016

  • CVE-2016-0182
    37İzleyin

    Windows Journal in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attac

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · windows 1010 May 2016

  • CVE-2016-0183
    40Planlayın

    The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web

    YüksekCVSS 8,8İstismar yokEPSS %15

    microsoft · office10 May 2016

  • CVE-2016-0184
    41Planlayın

    Use-after-free vulnerability in GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows

    YüksekCVSS 8,8İstismar yokEPSS %18

    microsoft · windows 1010 May 2016

  • CVE-2016-0185
    82Hemen

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %69

    microsoft · windows 710 May 2016

  • CVE-2016-0186
    36İzleyin

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5İstismar yokEPSS %19

    microsoft · edge10 May 2016

  • CVE-2016-0187
    36İzleyin

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attac

    YüksekCVSS 7,5İstismar yokEPSS %21

    microsoft · jscript10 May 2016

  • CVE-2016-0188
    40Planlayın

    The User Mode Code Integrity (UMCI) implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a cod

    YüksekCVSS 8,8İstismar yokEPSS %18

    microsoft · internet explorer10 May 2016

  • CVE-2016-0189
    88Hemen

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %94

    microsoft · jscript10 May 2016

  • CVE-2016-0191
    38İzleyin

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5İstismar yokEPSS %28

    microsoft · edge10 May 2016

  • CVE-2016-0192
    35İzleyin

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge10 May 2016

  • CVE-2016-0193
    36İzleyin

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5İstismar yokEPSS %20

    microsoft · edge10 May 2016

  • CVE-2016-0194
    26İzleyin

    Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web

    OrtaCVSS 5,3İstismar yokEPSS %15

    microsoft · internet explorer10 May 2016

  • CVE-2016-0195
    41Planlayın

    The Imaging Component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Go

    YüksekCVSS 8,8İstismar yokEPSS %18

    microsoft · windows 1010 May 2016

  • CVE-2016-0198
    40Planlayın

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O

    YüksekCVSS 7,8İstismar yokEPSS %29

    microsoft · office10 May 2016

  • CVE-2016-4117
    97Hemen

    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %94

    adobe · flash player10 May 2016

  • CVE-2016-1051
    42Planlayın

    Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acro

    KritikCVSS 9,8İstismar yokEPSS %11

    adobe · acrobat11 May 2016

  • CVE-2016-1077
    44Planlayın

    Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Contin

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    adobe · acrobat11 May 2016

  • CVE-2016-1079
    33İzleyin

    Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Contin

    YüksekCVSS 7,5İstismar yokEPSS %10

    adobe · acrobat11 May 2016

  • CVE-2016-1096
    42Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %39

    adobe · flash player11 May 2016

  • CVE-2016-1098
    33İzleyin

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · edge11 May 2016

  • CVE-2016-1099
    33İzleyin

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · edge11 May 2016

  • CVE-2016-1100
    33İzleyin

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5İstismar yokEPSS %10

    adobe · flash player11 May 2016

  • CVE-2016-1101
    41Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %37

    adobe · flash player11 May 2016

  • CVE-2016-1102
    42Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %39

    microsoft · edge11 May 2016

  • CVE-2016-1103
    41Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %37

    microsoft · edge11 May 2016

  • CVE-2016-1104
    42Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %39

    microsoft · edge11 May 2016

  • CVE-2016-1105
    41Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %37

    microsoft · edge11 May 2016

  • CVE-2016-1106
    41Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %37

    microsoft · edge11 May 2016

  • CVE-2016-4108
    41Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 7,5Kavram kanıtıEPSS %37

    microsoft · edge11 May 2016

  • CVE-2010-5326
    75Bu hafta

    The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows r

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %17

    sap · netweaver application server java13 May 2016

  • CVE-2016-1209
    60Bu hafta

    The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized

    KritikCVSS 9,8SilahlaştırılmışEPSS %61

    ninjaforms · ninja forms14 May 2016

  • CVE-2016-2296
    60Bu hafta

    Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows rem

    KritikCVSS 9,4SilahlaştırılmışEPSS %64

    meteocontrol · web\'log basic 10014 May 2016

  • CVE-2016-2298
    60Bu hafta

    Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecif

    KritikCVSS 9,8SilahlaştırılmışEPSS %25

    meteocontrol · web\'log basic 10014 May 2016

  • CVE-2015-4599
    42Planlayın

    The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attacker

    KritikCVSS 9,8İstismar yokEPSS %10

    php · php16 May 2016

  • CVE-2015-4600
    42Planlayın

    The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of

    KritikCVSS 9,8İstismar yokEPSS %10

    php · php16 May 2016

  • CVE-2015-4602
    42Planlayın

    The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 all

    KritikCVSS 9,8İstismar yokEPSS %10

    php · php16 May 2016

  • CVE-2015-4603
    42Planlayın

    The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows

    KritikCVSS 9,8İstismar yokEPSS %11

    php · php16 May 2016

  • CVE-2015-4643
    44Planlayın

    Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remo

    KritikCVSS 9,8İstismar yokEPSS %16

    php · php16 May 2016

  • CVE-2015-6834
    53Planlayın

    Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute

    KritikCVSS 9,8Kavram kanıtıEPSS %46

    php · php16 May 2016

  • CVE-2015-6835
    50Planlayın

    The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, w

    KritikCVSS 9,8Kavram kanıtıEPSS %36

    php · php16 May 2016

  • CVE-2016-2554
    42Planlayın

    Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cau

    KritikCVSS 9,8İstismar yokEPSS %10

    php · php16 May 2016

  • CVE-2016-2208
    42Planlayın

    The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cau

    KritikCVSS 9,1Kavram kanıtıEPSS %19

    symantec · anti-virus engine19 May 2016

  • CVE-2016-4071
    45Planlayın

    Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    php · php20 May 2016

  • CVE-2016-4543
    43Planlayın

    The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate I

    KritikCVSS 9,8İstismar yokEPSS %11

    hp · system management homepage21 May 2016

  • CVE-2016-4557
    40Planlayın

    The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data str

    YüksekCVSS 7,8SilahlaştırılmışEPSS %10

    linux · linux kernel23 May 2016

  • CVE-2016-0718
    43Planlayın

    Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input docum

    KritikCVSS 9,8İstismar yokEPSS %13

    mozilla · firefox26 May 2016