İçeriğe atla
Noroxi

Yayın tarihine göre

Haziran 2016: sömürülen ve yeni ciddi CVE kayıtları

65 kayıt · 6 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-3088
    99Hemen

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTT

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    apache · activemq1 Haz 2016

  • CVE-2015-7611
    60Bu hafta

    Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unsp

    YüksekCVSS 8,1SilahlaştırılmışEPSS %68

    apache · james server7 Haz 2016

  • CVE-2016-4437
    97Hemen

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbit

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    apache · aurora7 Haz 2016

  • CVE-2016-4450
    35İzleyin

    os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer deref

    YüksekCVSS 7,5İstismar yokEPSS %16

    canonical · ubuntu linux7 Haz 2016

  • CVE-2016-3087
    64Bu hafta

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker

    KritikCVSS 9,8SilahlaştırılmışEPSS %81

    apache · struts7 Haz 2016

  • CVE-2016-4359
    44Planlayın

    Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3,

    KritikCVSS 9,8İstismar yokEPSS %15

    hp · loadrunner8 Haz 2016

  • CVE-2016-5108
    46Planlayın

    Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    videolan · vlc media player8 Haz 2016

  • CVE-2016-4510
    42Planlayın

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and r

    KritikCVSS 9,1İstismar yokEPSS %20

    trihedral · vtscada9 Haz 2016

  • CVE-2016-4523
    69Bu hafta

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %31

    trihedral · vtscada9 Haz 2016

  • CVE-2016-4532
    44Planlayın

    Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote att

    KritikCVSS 9,1İstismar yokEPSS %27

    trihedral · vtscada9 Haz 2016

  • CVE-2016-4447
    34İzleyin

    The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-b

    YüksekCVSS 7,5İstismar yokEPSS %13

    hp · icewall federation agent9 Haz 2016

  • CVE-2016-5118
    54Planlayın

    The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (p

    KritikCVSS 9,8İstismar yokEPSS %49

    graphicsmagick · graphicsmagick10 Haz 2016

  • CVE-2016-2819
    42Planlayın

    Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code

    YüksekCVSS 8,8Kavram kanıtıEPSS %23

    mozilla · firefox13 Haz 2016

  • CVE-2016-1542
    60Bu hafta

    The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote at

    YüksekCVSS 7,5SilahlaştırılmışEPSS %74

    bmc · bladelogic server automation console13 Haz 2016

  • CVE-2016-1543
    60Bu hafta

    The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remot

    YüksekCVSS 7,5SilahlaştırılmışEPSS %71

    bmc · bladelogic server automation console13 Haz 2016

  • CVE-2016-0028
    29İzleyin

    Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative

    OrtaCVSS 5,5İstismar yokEPSS %22

    microsoft · exchange server15 Haz 2016

  • CVE-2016-0199
    50Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8Kavram kanıtıEPSS %50

    microsoft · internet explorer15 Haz 2016

  • CVE-2016-0200
    41Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8İstismar yokEPSS %20

    microsoft · internet explorer15 Haz 2016

  • CVE-2016-3198
    36İzleyin

    Microsoft Edge allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted document, aka "Microso

    OrtaCVSS 6,5İstismar yokEPSS %32

    microsoft · edge15 Haz 2016

  • CVE-2016-3199
    43Planlayın

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 8,8İstismar yokEPSS %26

    microsoft · edge15 Haz 2016

  • CVE-2016-3201
    33İzleyin

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensit

    OrtaCVSS 6,5İstismar yokEPSS %23

    microsoft · edge15 Haz 2016

  • CVE-2016-3202
    35İzleyin

    The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft E

    YüksekCVSS 7,5İstismar yokEPSS %17

    microsoft · edge15 Haz 2016

  • CVE-2016-3203
    41Planlayın

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to execute arbit

    YüksekCVSS 7,8İstismar yokEPSS %33

    microsoft · edge15 Haz 2016

  • CVE-2016-3205
    34İzleyin

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · jscript15 Haz 2016

  • CVE-2016-3206
    34İzleyin

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · jscript15 Haz 2016

  • CVE-2016-3207
    35İzleyin

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo

    YüksekCVSS 7,5İstismar yokEPSS %17

    microsoft · jscript15 Haz 2016

  • CVE-2016-3210
    42Planlayın

    The Microsoft (1) JScript and (2) VBScript engines, as used in Internet Explorer 11, allow remote attackers to execute arbitrary code or cau

    YüksekCVSS 8,8İstismar yokEPSS %21

    microsoft · internet explorer15 Haz 2016

  • CVE-2016-3211
    45Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8İstismar yokEPSS %31

    microsoft · internet explorer15 Haz 2016

  • CVE-2016-3212
    27İzleyin

    The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers

    OrtaCVSS 6,1İstismar yokEPSS %10

    microsoft · internet explorer15 Haz 2016

  • CVE-2016-3213
    60Bu hafta

    The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP

    YüksekCVSS 8,8SilahlaştırılmışEPSS %66

    microsoft · internet explorer15 Haz 2016

  • CVE-2016-3214
    40Planlayın

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 8,8İstismar yokEPSS %16

    microsoft · edge15 Haz 2016

  • CVE-2016-3215
    32İzleyin

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive infor

    OrtaCVSS 5,5İstismar yokEPSS %33

    microsoft · windows 1015 Haz 2016

  • CVE-2016-3216
    24İzleyin

    GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows

    OrtaCVSS 4,3Kavram kanıtıEPSS %24

    microsoft · windows 1015 Haz 2016

  • CVE-2016-3222
    52Planlayın

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 8,8Kavram kanıtıEPSS %56

    microsoft · edge15 Haz 2016

  • CVE-2016-3223
    38İzleyin

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1

    YüksekCVSS 8,1Kavram kanıtıEPSS %21

    microsoft · windows 1015 Haz 2016

  • CVE-2016-3225
    44Planlayın

    The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

    YüksekCVSS 7,8SilahlaştırılmışEPSS %43

    microsoft · windows 1015 Haz 2016

  • CVE-2016-3226
    29İzleyin

    Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of

    OrtaCVSS 6,5İstismar yokEPSS %10

    microsoft · windows server 200815 Haz 2016

  • CVE-2016-3227
    47Planlayın

    Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arb

    KritikCVSS 9,8İstismar yokEPSS %25

    microsoft · windows server 201215 Haz 2016

  • CVE-2016-3228
    39İzleyin

    Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows Server 2012 Gold and R2 allow remote authenticated users to execute arbitrary code

    YüksekCVSS 8,8İstismar yokEPSS %13

    microsoft · windows server 200815 Haz 2016

  • CVE-2016-3235
    74Bu hafta

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %43

    microsoft · visio15 Haz 2016

  • CVE-2016-3236
    62Bu hafta

    The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP

    KritikCVSS 9,8SilahlaştırılmışEPSS %76

    microsoft · windows 1015 Haz 2016

  • CVE-2016-0025
    34İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 20

    YüksekCVSS 7,3İstismar yokEPSS %16

    microsoft · office16 Haz 2016

  • CVE-2016-3233
    33İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted O

    YüksekCVSS 7,3İstismar yokEPSS %14

    microsoft · excel16 Haz 2016

  • CVE-2016-3234
    30İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint

    OrtaCVSS 5,5İstismar yokEPSS %26

    microsoft · office16 Haz 2016

  • CVE-2016-4121
    42Planlayın

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before

    KritikCVSS 9,8İstismar yokEPSS %10

    adobe · flash player16 Haz 2016

  • CVE-2016-4135
    40Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    adobe · flash player16 Haz 2016

  • CVE-2016-4136
    40Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    adobe · flash player16 Haz 2016

  • CVE-2016-4137
    40Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    adobe · flash player16 Haz 2016

  • CVE-2016-4138
    47Planlayın

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    adobe · flash player16 Haz 2016

  • CVE-2016-4171
    75Bu hafta

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %20

    adobe · flash player16 Haz 2016

  • CVE-2016-3642
    43Planlayın

    The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted s

    KritikCVSS 9,8İstismar yokEPSS %13

    solarwinds · virtualization manager17 Haz 2016

  • CVE-2016-3643
    62Bu hafta

    SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demons

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    solarwinds · virtualization manager17 Haz 2016

  • CVE-2016-2177
    52Planlayın

    OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a de

    KritikCVSS 9,8İstismar yokEPSS %44

    openssl · openssl19 Haz 2016

  • CVE-2016-4309
    33İzleyin

    Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessi

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    getsymphony · symphony30 Haz 2016

  • CVE-2016-4971
    49Planlayın

    GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

    YüksekCVSS 8,8Kavram kanıtıEPSS %46

    gnu · wget30 Haz 2016

  • CVE-2016-5360
    43Planlayın

    HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memor

    YüksekCVSS 7,5İstismar yokEPSS %42

    haproxy · haproxy30 Haz 2016

  • CVE-2016-3189
    31İzleyin

    Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2

    OrtaCVSS 6,5İstismar yokEPSS %15

    bzip · bzip230 Haz 2016

  • CVE-2016-4472
    36İzleyin

    The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial

    YüksekCVSS 8,1İstismar yokEPSS %11

    libexpat project · libexpat30 Haz 2016

  • CVE-2016-2207
    38İzleyin

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    YüksekCVSS 8,4Kavram kanıtıEPSS %18

    symantec · mail security for microsoft exchange30 Haz 2016

  • CVE-2016-2209
    35İzleyin

    Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security

    YüksekCVSS 7,3Kavram kanıtıEPSS %20

    symantec · mail security for microsoft exchange30 Haz 2016

  • CVE-2016-2210
    32İzleyin

    Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Securit

    YüksekCVSS 7,3Kavram kanıtıEPSS %11

    symantec · mail security for microsoft exchange30 Haz 2016

  • CVE-2016-2211
    47Planlayın

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    YüksekCVSS 7,8İstismar yokEPSS %53

    symantec · mail security for microsoft exchange30 Haz 2016

  • CVE-2016-3644
    38İzleyin

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    YüksekCVSS 8,4Kavram kanıtıEPSS %17

    symantec · norton security30 Haz 2016

  • CVE-2016-3645
    46Planlayın

    Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    symantec · norton security30 Haz 2016

  • CVE-2016-3646
    38İzleyin

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    YüksekCVSS 8,4Kavram kanıtıEPSS %17

    symantec · norton security30 Haz 2016