İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2016: sömürülen ve yeni ciddi CVE kayıtları

55 kayıt · 8 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-7855
    73Bu hafta

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote atta

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %25

    adobe · flash player1 Kas 2016

  • CVE-2016-8864
    42Planlayın

    named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of ser

    YüksekCVSS 7,5İstismar yokEPSS %38

    isc · bind2 Kas 2016

  • CVE-2016-8869
    68Bu hafta

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote

    KritikCVSS 9,8SilahlaştırılmışEPSS %97

    joomla · joomla\!4 Kas 2016

  • CVE-2016-8870
    60Bu hafta

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registr

    YüksekCVSS 8,1SilahlaştırılmışEPSS %81

    joomla · joomla\!4 Kas 2016

  • CVE-2016-3340
    35İzleyin

    The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win

    YüksekCVSS 7,8İstismar yokEPSS %12

    microsoft · windows 1010 Kas 2016

  • CVE-2016-3342
    35İzleyin

    The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win

    YüksekCVSS 7,8İstismar yokEPSS %12

    microsoft · windows 1010 Kas 2016

  • CVE-2016-3343
    35İzleyin

    The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win

    YüksekCVSS 7,8İstismar yokEPSS %12

    microsoft · windows 1010 Kas 2016

  • CVE-2016-7195
    35İzleyin

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge10 Kas 2016

  • CVE-2016-7196
    34İzleyin

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge10 Kas 2016

  • CVE-2016-7198
    34İzleyin

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge10 Kas 2016

  • CVE-2016-7199
    16İzleyin

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive win

    DüşükCVSS 3,1İstismar yokEPSS %13

    microsoft · edge10 Kas 2016

  • CVE-2016-7200
    90Hemen

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %82

    microsoft · edge10 Kas 2016

  • CVE-2016-7201
    89Hemen

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %80

    microsoft · edge10 Kas 2016

  • CVE-2016-7202
    52Planlayın

    The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cau

    YüksekCVSS 7,5Kavram kanıtıEPSS %73

    microsoft · edge10 Kas 2016

  • CVE-2016-7203
    49Planlayın

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    YüksekCVSS 7,5Kavram kanıtıEPSS %64

    microsoft · edge10 Kas 2016

  • CVE-2016-7204
    15İzleyin

    Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disc

    DüşükCVSS 3,1İstismar yokEPSS %11

    microsoft · edge10 Kas 2016

  • CVE-2016-7205
    41Planlayın

    Animation Manager in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind

    YüksekCVSS 8,8İstismar yokEPSS %21

    microsoft · windows 1010 Kas 2016

  • CVE-2016-7208
    35İzleyin

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge10 Kas 2016

  • CVE-2016-7210
    32İzleyin

    atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W

    OrtaCVSS 6,5İstismar yokEPSS %21

    microsoft · windows 1010 Kas 2016

  • CVE-2016-7212
    52Planlayın

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1

    YüksekCVSS 7,8İstismar yokEPSS %69

    microsoft · windows 1010 Kas 2016

  • CVE-2016-7213
    37İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · excel10 Kas 2016

  • CVE-2016-7217
    41Planlayın

    Media Foundation in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Ser

    YüksekCVSS 8,8İstismar yokEPSS %21

    microsoft · windows 1010 Kas 2016

  • CVE-2016-7227
    15İzleyin

    The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of lo

    DüşükCVSS 3,1İstismar yokEPSS %11

    microsoft · edge10 Kas 2016

  • CVE-2016-7228
    39İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office

    YüksekCVSS 7,8İstismar yokEPSS %28

    microsoft · excel10 Kas 2016

  • CVE-2016-7229
    37İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · excel10 Kas 2016

  • CVE-2016-7230
    37İzleyin

    Microsoft PowerPoint 2010 SP2, PowerPoint Viewer, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafte

    YüksekCVSS 7,8İstismar yokEPSS %18

    microsoft · office web apps10 Kas 2016

  • CVE-2016-7231
    37İzleyin

    Microsoft Excel 2007 SP3, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary co

    YüksekCVSS 7,8İstismar yokEPSS %18

    microsoft · excel10 Kas 2016

  • CVE-2016-7232
    38İzleyin

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, and Office Compatibility Pack SP3 allow remote attackers to execute

    YüksekCVSS 7,8İstismar yokEPSS %24

    microsoft · office10 Kas 2016

  • CVE-2016-7233
    33İzleyin

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word

    OrtaCVSS 6,5İstismar yokEPSS %22

    microsoft · excel for mac10 Kas 2016

  • CVE-2016-7234
    38İzleyin

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Excel for Mac 2011, Word 2016 for M

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · excel for mac10 Kas 2016

  • CVE-2016-7235
    37İzleyin

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, and Office Compatibility Pack SP3 allow remote a

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · excel for mac10 Kas 2016

  • CVE-2016-7236
    37İzleyin

    Microsoft Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · excel10 Kas 2016

  • CVE-2016-7237
    46Planlayın

    Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window

    OrtaCVSS 6,5Kavram kanıtıEPSS %67

    microsoft · windows 1010 Kas 2016

  • CVE-2016-7239
    15İzleyin

    The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-si

    DüşükCVSS 3,1İstismar yokEPSS %11

    microsoft · edge10 Kas 2016

  • CVE-2016-7240
    50Planlayın

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    YüksekCVSS 7,5Kavram kanıtıEPSS %66

    microsoft · edge10 Kas 2016

  • CVE-2016-7241
    51Planlayın

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr

    YüksekCVSS 7,5Kavram kanıtıEPSS %71

    microsoft · edge10 Kas 2016

  • CVE-2016-7242
    35İzleyin

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge10 Kas 2016

  • CVE-2016-7243
    35İzleyin

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge10 Kas 2016

  • CVE-2016-7245
    37İzleyin

    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, and Office 2016 allow remote attackers to execute arbitrary

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · office10 Kas 2016

  • CVE-2016-7248
    38İzleyin

    Microsoft Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allo

    YüksekCVSS 7,8İstismar yokEPSS %21

    microsoft · windows 1010 Kas 2016

  • CVE-2016-7249
    39İzleyin

    Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privil

    YüksekCVSS 8,8İstismar yokEPSS %11

    microsoft · sql server10 Kas 2016

  • CVE-2016-7250
    39İzleyin

    Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authentica

    YüksekCVSS 8,8İstismar yokEPSS %11

    microsoft · sql server10 Kas 2016

  • CVE-2016-7252
    31İzleyin

    Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors

    OrtaCVSS 6,5İstismar yokEPSS %17

    microsoft · sql server10 Kas 2016

  • CVE-2016-7253
    39İzleyin

    The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows

    YüksekCVSS 8,8İstismar yokEPSS %11

    microsoft · sql server10 Kas 2016

  • CVE-2016-7254
    39İzleyin

    Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated use

    YüksekCVSS 8,8İstismar yokEPSS %11

    microsoft · sql server10 Kas 2016

  • CVE-2016-7255
    85Hemen

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %80

    microsoft · windows 10 150710 Kas 2016

  • CVE-2016-7256
    84Hemen

    atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %64

    microsoft · windows 10 150710 Kas 2016

  • CVE-2016-7244
    27İzleyin

    Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Micros

    OrtaCVSS 5,5İstismar yokEPSS %16

    microsoft · office10 Kas 2016

  • CVE-2016-5195
    83Hemen

    Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect ha

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %83

    linux · linux kernel10 Kas 2016

  • CVE-2016-8562
    61Bu hafta

    A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28).

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %3

    siemens · simatic cp 1543-1 firmware18 Kas 2016

  • CVE-2016-9150
    49Planlayın

    Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    paloaltonetworks · pan-os19 Kas 2016

  • CVE-2016-9563
    63Bu hafta

    BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~t

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %24

    sap · netweaver application server java22 Kas 2016

  • CVE-2016-1248
    39İzleyin

    vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execu

    YüksekCVSS 7,8İstismar yokEPSS %25

    vim · vim23 Kas 2016

  • CVE-2015-1328
    42Planlayın

    The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check per

    YüksekCVSS 7,8SilahlaştırılmışEPSS %37

    linux · linux kernel27 Kas 2016

  • CVE-2016-9555
    42Planlayın

    The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which

    KritikCVSS 9,8İstismar yokEPSS %10

    linux · linux kernel27 Kas 2016