İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2016: sömürülen ve yeni ciddi CVE kayıtları

41 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-1240
    40Planlayın

    The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tom

    YüksekCVSS 7,8SilahlaştırılmışEPSS %9

    debian · debian linux3 Eki 2016

  • CVE-2015-1832
    40Planlayın

    XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in plac

    KritikCVSS 9,1İstismar yokEPSS %12

    apache · derby3 Eki 2016

  • CVE-2016-6433
    59Planlayın

    The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrar

    YüksekCVSS 8,8SilahlaştırılmışEPSS %80

    cisco · secure firewall management center6 Eki 2016

  • CVE-2016-6435
    40Planlayın

    The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters,

    OrtaCVSS 6,5SilahlaştırılmışEPSS %36

    cisco · secure firewall management center6 Eki 2016

  • CVE-2015-2080
    53Planlayın

    The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process mem

    YüksekCVSS 7,5Kavram kanıtıEPSS %75

    eclipse · jetty7 Eki 2016

  • CVE-2016-7167
    43Planlayın

    Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl

    KritikCVSS 9,8İstismar yokEPSS %11

    fedoraproject · fedora7 Eki 2016

  • CVE-2016-7117
    46Planlayın

    Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to exec

    KritikCVSS 9,8İstismar yokEPSS %23

    linux · linux kernel10 Eki 2016

  • CVE-2016-5425
    40Planlayın

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak perm

    YüksekCVSS 7,8SilahlaştırılmışEPSS %3

    oracle · instantis enterprisetrack13 Eki 2016

  • CVE-2016-7065
    39İzleyin

    The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of servic

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    redhat · jboss enterprise application platform13 Eki 2016

  • CVE-2016-4273
    41Planlayın

    Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows att

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    adobe · flash player13 Eki 2016

  • CVE-2016-0070
    25İzleyin

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

    OrtaCVSS 5,5Kavram kanıtıEPSS %11

    microsoft · windows 1013 Eki 2016

  • CVE-2016-0142
    37İzleyin

    Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · windows 1013 Eki 2016

  • CVE-2016-3209
    38İzleyin

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    OrtaCVSS 5,5Kavram kanıtıEPSS %53

    microsoft · .net framework13 Eki 2016

  • CVE-2016-3262
    32İzleyin

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    OrtaCVSS 5,5İstismar yokEPSS %31

    microsoft · live meeting13 Eki 2016

  • CVE-2016-3263
    32İzleyin

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    OrtaCVSS 5,5İstismar yokEPSS %31

    microsoft · live meeting13 Eki 2016

  • CVE-2016-3267
    26İzleyin

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of unspecified files via a cra

    OrtaCVSS 5,3İstismar yokEPSS %15

    microsoft · edge13 Eki 2016

  • CVE-2016-3298
    66Bu hafta

    Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Window

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %33

    microsoft · internet explorer13 Eki 2016

  • CVE-2016-3331
    34İzleyin

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge13 Eki 2016

  • CVE-2016-3376
    35İzleyin

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

    YüksekCVSS 7,8Kavram kanıtıEPSS %12

    microsoft · windows 1013 Eki 2016

  • CVE-2016-3382
    35İzleyin

    The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cau

    YüksekCVSS 7,5İstismar yokEPSS %17

    microsoft · edge13 Eki 2016

  • CVE-2016-3383
    34İzleyin

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · internet explorer13 Eki 2016

  • CVE-2016-3384
    34İzleyin

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 7,5İstismar yokEPSS %12

    microsoft · internet explorer13 Eki 2016

  • CVE-2016-3385
    37İzleyin

    The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of serv

    YüksekCVSS 7,5İstismar yokEPSS %23

    microsoft · internet explorer13 Eki 2016

  • CVE-2016-3386
    42Planlayın

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5Kavram kanıtıEPSS %41

    microsoft · edge13 Eki 2016

  • CVE-2016-3387
    36İzleyin

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attacker

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    microsoft · edge13 Eki 2016

  • CVE-2016-3388
    29İzleyin

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attacker

    OrtaCVSS 5,3Kavram kanıtıEPSS %27

    microsoft · edge13 Eki 2016

  • CVE-2016-3389
    35İzleyin

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge13 Eki 2016

  • CVE-2016-3390
    35İzleyin

    The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denia

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge13 Eki 2016

  • CVE-2016-3393
    82Hemen

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %68

    microsoft · windows 10 150713 Eki 2016

  • CVE-2016-3396
    38İzleyin

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    YüksekCVSS 7,8İstismar yokEPSS %24

    microsoft · live meeting13 Eki 2016

  • CVE-2016-7182
    48Planlayın

    The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 G

    KritikCVSS 9,8Kavram kanıtıEPSS %30

    microsoft · live meeting13 Eki 2016

  • CVE-2016-7189
    44Planlayın

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engi

    YüksekCVSS 7,5Kavram kanıtıEPSS %48

    microsoft · edge13 Eki 2016

  • CVE-2016-7190
    50Planlayın

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5Kavram kanıtıEPSS %66

    microsoft · edge13 Eki 2016

  • CVE-2016-7193
    78Bu hafta

    Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibi

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %57

    microsoft · office13 Eki 2016

  • CVE-2016-7194
    47Planlayın

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    YüksekCVSS 7,5Kavram kanıtıEPSS %57

    microsoft · edge13 Eki 2016

  • CVE-2016-2848
    38İzleyin

    ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemo

    YüksekCVSS 7,5İstismar yokEPSS %25

    isc · bind21 Eki 2016

  • CVE-2016-3473
    34İzleyin

    Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.

    YüksekCVSS 7,7Kavram kanıtıEPSS %13

    oracle · business intelligence publisher25 Eki 2016

  • CVE-2016-1000031
    49Planlayın

    Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

    KritikCVSS 9,8İstismar yokEPSS %33

    apache · commons fileupload25 Eki 2016

  • CVE-2016-8339
    43Planlayın

    A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent.

    KritikCVSS 9,8İstismar yokEPSS %14

    redislabs · redis28 Eki 2016

  • CVE-2016-8581
    60Bu hafta

    A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an

    OrtaCVSS 6,1SilahlaştırılmışEPSS %17

    alienvault · open source security information and event management28 Eki 2016

  • CVE-2016-8582
    60Bu hafta

    A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and r

    KritikCVSS 9,8SilahlaştırılmışEPSS %57

    alienvault · open source security information and event management28 Eki 2016