İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2016: sömürülen ve yeni ciddi CVE kayıtları

68 kayıt · 2 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-4264
    55Planlayın

    The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrar

    YüksekCVSS 8,6Kavram kanıtıEPSS %69

    adobe · coldfusion1 Eyl 2016

  • CVE-2016-6483
    38İzleyin

    The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.

    YüksekCVSS 8,6Kavram kanıtıEPSS %11

    vbulletin · vbulletin1 Eyl 2016

  • CVE-2016-0772
    30İzleyin

    The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS f

    OrtaCVSS 6,5Kavram kanıtıEPSS %14

    python · python2 Eyl 2016

  • CVE-2016-5636
    47Planlayın

    Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 all

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    python · python2 Eyl 2016

  • CVE-2016-7152
    25İzleyin

    The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it eas

    OrtaCVSS 5,3İstismar yokEPSS %12

    opera · opera6 Eyl 2016

  • CVE-2016-7153
    25İzleyin

    The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it ea

    OrtaCVSS 5,3İstismar yokEPSS %12

    microsoft · edge6 Eyl 2016

  • CVE-2016-6855
    36İzleyin

    Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remo

    YüksekCVSS 7,5Kavram kanıtıEPSS %18

    gnome · eye of gnome7 Eyl 2016

  • CVE-2016-7124
    44Planlayın

    ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers

    KritikCVSS 9,8İstismar yokEPSS %16

    php · php11 Eyl 2016

  • CVE-2016-0138
    21İzleyin

    Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · exchange server14 Eyl 2016

  • CVE-2016-3247
    51Planlayın

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr

    YüksekCVSS 7,5Kavram kanıtıEPSS %71

    microsoft · edge14 Eyl 2016

  • CVE-2016-3291
    13İzleyin

    Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive informa

    DüşükCVSS 2,4İstismar yokEPSS %13

    microsoft · edge14 Eyl 2016

  • CVE-2016-3294
    34İzleyin

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge14 Eyl 2016

  • CVE-2016-3295
    34İzleyin

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge14 Eyl 2016

  • CVE-2016-3297
    42Planlayın

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 8,8İstismar yokEPSS %22

    microsoft · edge14 Eyl 2016

  • CVE-2016-3324
    44Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8Kavram kanıtıEPSS %28

    microsoft · internet explorer14 Eyl 2016

  • CVE-2016-3325
    28İzleyin

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Micros

    DüşükCVSS 3,1Kavram kanıtıEPSS %53

    microsoft · edge14 Eyl 2016

  • CVE-2016-3330
    34İzleyin

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · edge14 Eyl 2016

  • CVE-2016-3345
    45Planlayın

    The SMBv1 server in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an

    YüksekCVSS 8,8İstismar yokEPSS %32

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3348
    35İzleyin

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

    YüksekCVSS 7,8İstismar yokEPSS %12

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3350
    35İzleyin

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Eyl 2016

  • CVE-2016-3351
    64Bu hafta

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, a

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %26

    microsoft · internet explorer14 Eyl 2016

  • CVE-2016-3352
    41Planlayın

    Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which mak

    YüksekCVSS 8,8İstismar yokEPSS %20

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3353
    37İzleyin

    Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended acce

    YüksekCVSS 8,3İstismar yokEPSS %11

    microsoft · internet explorer14 Eyl 2016

  • CVE-2016-3354
    17İzleyin

    The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows

    DüşükCVSS 3,3İstismar yokEPSS %14

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3356
    37İzleyin

    The Graphics Device Interface (GDI) in Microsoft Windows 10 1607 allows remote attackers to execute arbitrary code via a crafted document, a

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3358
    37İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Compatibility Pack SP3,

    YüksekCVSS 7,8İstismar yokEPSS %18

    microsoft · excel14 Eyl 2016

  • CVE-2016-3359
    36İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code v

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · excel14 Eyl 2016

  • CVE-2016-3360
    36İzleyin

    Microsoft PowerPoint 2007 SP3, PowerPoint 2010 SP2, PowerPoint 2013 SP1, PowerPoint 2013 RT SP1, PowerPoint 2016 for Mac, Office Compatibili

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · office compatibility pack14 Eyl 2016

  • CVE-2016-3361
    36İzleyin

    Microsoft Excel 2010 SP2 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption V

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · excel14 Eyl 2016

  • CVE-2016-3362
    36İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · excel14 Eyl 2016

  • CVE-2016-3363
    37İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer all

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · excel14 Eyl 2016

  • CVE-2016-3364
    37İzleyin

    Microsoft Visio 2016 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulne

    YüksekCVSS 7,8İstismar yokEPSS %18

    microsoft · visio14 Eyl 2016

  • CVE-2016-3365
    37İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · excel14 Eyl 2016

  • CVE-2016-3366
    31İzleyin

    Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly

    OrtaCVSS 6,5İstismar yokEPSS %16

    microsoft · outlook14 Eyl 2016

  • CVE-2016-3367
    40Planlayın

    StringBuilder in Microsoft Silverlight 5 before 5.1.50709.0 does not properly allocate memory for string-insert and string-append operations

    YüksekCVSS 8,8İstismar yokEPSS %17

    microsoft · silverlight14 Eyl 2016

  • CVE-2016-3368
    40Planlayın

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1

    YüksekCVSS 8,8İstismar yokEPSS %18

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3369
    34İzleyin

    Microsoft Windows 10 Gold and 1511 allows attackers to cause a denial of service via unspecified vectors, aka "Windows Denial of Service Vul

    YüksekCVSS 7,5İstismar yokEPSS %12

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3370
    33İzleyin

    The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows

    OrtaCVSS 6,5İstismar yokEPSS %22

    microsoft · edge14 Eyl 2016

  • CVE-2016-3371
    34İzleyin

    The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and

    OrtaCVSS 5,5Kavram kanıtıEPSS %40

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3373
    27İzleyin

    The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and

    OrtaCVSS 5,5Kavram kanıtıEPSS %17

    microsoft · windows 1014 Eyl 2016

  • CVE-2016-3374
    34İzleyin

    The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows

    OrtaCVSS 6,5İstismar yokEPSS %25

    microsoft · edge14 Eyl 2016

  • CVE-2016-3375
    35İzleyin

    The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 20

    YüksekCVSS 7,5İstismar yokEPSS %17

    microsoft · internet explorer14 Eyl 2016

  • CVE-2016-3377
    35İzleyin

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Eyl 2016

  • CVE-2016-3378
    34İzleyin

    Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Upd

    YüksekCVSS 7,4İstismar yokEPSS %15

    microsoft · exchange server14 Eyl 2016

  • CVE-2016-3381
    35İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer all

    YüksekCVSS 7,8İstismar yokEPSS %14

    microsoft · excel14 Eyl 2016

  • CVE-2016-3357
    47Planlayın

    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Vie

    YüksekCVSS 7,8Kavram kanıtıEPSS %54

    microsoft · office14 Eyl 2016

  • CVE-2016-4275
    41Planlayın

    Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    adobe · flash player14 Eyl 2016

  • CVE-2016-2179
    38İzleyin

    The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order

    YüksekCVSS 7,5İstismar yokEPSS %26

    openssl · openssl16 Eyl 2016

  • CVE-2016-2181
    37İzleyin

    The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a

    YüksekCVSS 7,5İstismar yokEPSS %22

    openssl · openssl16 Eyl 2016

  • CVE-2016-2182
    53Planlayın

    The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote atta

    KritikCVSS 9,8İstismar yokEPSS %46

    openssl · openssl16 Eyl 2016

  • CVE-2016-6302
    38İzleyin

    The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket leng

    YüksekCVSS 7,5İstismar yokEPSS %27

    openssl · openssl16 Eyl 2016

  • CVE-2016-6303
    49Planlayın

    Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of

    KritikCVSS 9,8İstismar yokEPSS %31

    openssl · openssl16 Eyl 2016

  • CVE-2016-7418
    33İzleyin

    The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial o

    YüksekCVSS 7,5İstismar yokEPSS %11

    php · php17 Eyl 2016

  • CVE-2016-6415
    86Hemen

    The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %87

    cisco · ios18 Eyl 2016

  • CVE-2015-8921
    34İzleyin

    The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bound

    YüksekCVSS 7,5İstismar yokEPSS %11

    libarchive · libarchive20 Eyl 2016

  • CVE-2016-6662
    59Planlayın

    Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before

    KritikCVSS 9,8Kavram kanıtıEPSS %67

    oracle · mysql20 Eyl 2016

  • CVE-2016-5426
    39İzleyin

    PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a

    YüksekCVSS 7,5İstismar yokEPSS %30

    powerdns · authoritative21 Eyl 2016

  • CVE-2016-5427
    49Planlayın

    PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a .

    YüksekCVSS 7,5İstismar yokEPSS %62

    powerdns · authoritative21 Eyl 2016

  • CVE-2016-6304
    49Planlayın

    Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a d

    YüksekCVSS 7,5İstismar yokEPSS %63

    openssl · openssl26 Eyl 2016

  • CVE-2016-6305
    35İzleyin

    The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (i

    YüksekCVSS 7,5İstismar yokEPSS %15

    openssl · openssl26 Eyl 2016

  • CVE-2016-6306
    36İzleyin

    The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bo

    OrtaCVSS 5,9İstismar yokEPSS %41

    openssl · openssl26 Eyl 2016

  • CVE-2016-6307
    27İzleyin

    The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow

    OrtaCVSS 5,9İstismar yokEPSS %13

    openssl · openssl26 Eyl 2016

  • CVE-2016-6308
    27İzleyin

    statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, whi

    OrtaCVSS 5,9İstismar yokEPSS %14

    openssl · openssl26 Eyl 2016

  • CVE-2016-6309
    60Bu hafta

    statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a den

    KritikCVSS 9,8İstismar yokEPSS %70

    openssl · openssl26 Eyl 2016

  • CVE-2016-7052
    39İzleyin

    crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application cras

    YüksekCVSS 7,5İstismar yokEPSS %29

    openssl · openssl26 Eyl 2016

  • CVE-2016-6330
    42Planlayın

    The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows

    KritikCVSS 9,8İstismar yokEPSS %10

    redhat · jboss operations network27 Eyl 2016

  • CVE-2016-2776
    60Bu hafta

    buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses,

    YüksekCVSS 7,5SilahlaştırılmışEPSS %89

    isc · bind28 Eyl 2016

  • CVE-2016-7191
    41Planlayın

    The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not rec

    YüksekCVSS 8,1İstismar yokEPSS %29

    microsoft · azure active directory passport28 Eyl 2016