İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2016: sömürülen ve yeni ciddi CVE kayıtları

53 kayıt · 4 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-9796
    43Planlayın

    Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    alcatel-lucent · omnivista 8770 network management system3 Ara 2016

  • CVE-2016-8740
    54Planlayın

    The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict

    YüksekCVSS 7,5Kavram kanıtıEPSS %79

    apache · http server5 Ara 2016

  • CVE-2016-8655
    40Planlayın

    Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of servi

    YüksekCVSS 7,8SilahlaştırılmışEPSS %11

    linux · linux kernel8 Ara 2016

  • CVE-2016-8858
    39İzleyin

    The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory cons

    YüksekCVSS 7,5Kavram kanıtıEPSS %29

    openbsd · openssh9 Ara 2016

  • CVE-2016-6321
    35İzleyin

    Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an i

    YüksekCVSS 7,5İstismar yokEPSS %15

    gnu · tar9 Ara 2016

  • CVE-2016-5841
    43Planlayın

    Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fa

    KritikCVSS 9,8İstismar yokEPSS %13

    imagemagick · imagemagick13 Ara 2016

  • CVE-2016-2334
    35İzleyin

    Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to

    YüksekCVSS 7,8Kavram kanıtıEPSS %14

    7-zip · 7-zip13 Ara 2016

  • CVE-2016-6277
    95Hemen

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    netgear · d6220 firmware14 Ara 2016

  • CVE-2016-7866
    44Planlayın

    Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    adobe · animate15 Ara 2016

  • CVE-2016-7867
    38İzleyin

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability i

    YüksekCVSS 8,8İstismar yokEPSS %10

    adobe · flash player desktop runtime15 Ara 2016

  • CVE-2016-7868
    38İzleyin

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability i

    YüksekCVSS 8,8İstismar yokEPSS %11

    adobe · flash player desktop runtime15 Ara 2016

  • CVE-2016-7869
    38İzleyin

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability i

    YüksekCVSS 8,8İstismar yokEPSS %11

    adobe · flash player desktop runtime15 Ara 2016

  • CVE-2016-7870
    38İzleyin

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability i

    YüksekCVSS 8,8İstismar yokEPSS %10

    adobe · flash player desktop runtime15 Ara 2016

  • CVE-2016-7892
    71Bu hafta

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFie

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %18

    adobe · flash player desktop runtime15 Ara 2016

  • CVE-2016-9565
    46Planlayın

    MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files b

    KritikCVSS 9,8Kavram kanıtıEPSS %22

    nagios · nagios15 Ara 2016

  • CVE-2016-9838
    34İzleyin

    An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5.

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    joomla · joomla\!16 Ara 2016

  • CVE-2016-9949
    36İzleyin

    An issue was discovered in Apport before 2.20.4.

    YüksekCVSS 7,8Kavram kanıtıEPSS %17

    apport project · apport16 Ara 2016

  • CVE-2016-7181
    34İzleyin

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · edge20 Ara 2016

  • CVE-2016-7206
    27İzleyin

    Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified ve

    OrtaCVSS 6,1İstismar yokEPSS %11

    microsoft · edge20 Ara 2016

  • CVE-2016-7257
    33İzleyin

    The GDI component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office for Mac 2011, and Office 2016 fo

    OrtaCVSS 6,5İstismar yokEPSS %22

    microsoft · office for mac20 Ara 2016

  • CVE-2016-7262
    78Bu hafta

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer all

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %57

    microsoft · excel20 Ara 2016

  • CVE-2016-7263
    37İzleyin

    Microsoft Excel for Mac 2011 and Excel 2016 for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory co

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · excel for mac20 Ara 2016

  • CVE-2016-7264
    35İzleyin

    Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, Excel for Mac 2011, and Excel 2016 for Mac allow remote attackers to

    YüksekCVSS 7,1İstismar yokEPSS %23

    microsoft · excel20 Ara 2016

  • CVE-2016-7265
    34İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel

    YüksekCVSS 7,1İstismar yokEPSS %21

    microsoft · excel20 Ara 2016

  • CVE-2016-7266
    38İzleyin

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Ex

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · excel20 Ara 2016

  • CVE-2016-7267
    28İzleyin

    Microsoft Excel 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 misparses file formats, which makes it easier for remote attackers to execute arbi

    OrtaCVSS 5,5İstismar yokEPSS %19

    microsoft · excel20 Ara 2016

  • CVE-2016-7268
    35İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word for Mac 2011, Word Automation Serv

    YüksekCVSS 7,1İstismar yokEPSS %22

    microsoft · office20 Ara 2016

  • CVE-2016-7270
    36İzleyin

    The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to byp

    YüksekCVSS 7,5İstismar yokEPSS %20

    microsoft · .net framework20 Ara 2016

  • CVE-2016-7272
    47Planlayın

    The Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G

    YüksekCVSS 8,8İstismar yokEPSS %39

    microsoft · windows 1020 Ara 2016

  • CVE-2016-7273
    41Planlayın

    The Graphics component in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows remote attackers to execute arbitrary cod

    YüksekCVSS 8,8İstismar yokEPSS %18

    microsoft · windows 1020 Ara 2016

  • CVE-2016-7274
    48Planlayın

    Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W

    YüksekCVSS 8,8Kavram kanıtıEPSS %42

    microsoft · windows 1020 Ara 2016

  • CVE-2016-7277
    43Planlayın

    Microsoft Office 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted docum

    KritikCVSS 9,6İstismar yokEPSS %17

    microsoft · office20 Ara 2016

  • CVE-2016-7278
    25İzleyin

    Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site,

    OrtaCVSS 5,3İstismar yokEPSS %14

    microsoft · internet explorer20 Ara 2016

  • CVE-2016-7279
    35İzleyin

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge20 Ara 2016

  • CVE-2016-7281
    25İzleyin

    The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin

    OrtaCVSS 5,3İstismar yokEPSS %13

    microsoft · edge20 Ara 2016

  • CVE-2016-7282
    27İzleyin

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject ar

    OrtaCVSS 6,1İstismar yokEPSS %10

    microsoft · edge20 Ara 2016

  • CVE-2016-7283
    40Planlayın

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    YüksekCVSS 8,8İstismar yokEPSS %17

    microsoft · internet explorer20 Ara 2016

  • CVE-2016-7284
    21İzleyin

    Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, ak

    OrtaCVSS 4,3İstismar yokEPSS %14

    microsoft · internet explorer20 Ara 2016

  • CVE-2016-7286
    51Planlayın

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi

    YüksekCVSS 7,5Kavram kanıtıEPSS %68

    microsoft · edge20 Ara 2016

  • CVE-2016-7287
    51Planlayın

    The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denia

    YüksekCVSS 7,5Kavram kanıtıEPSS %68

    microsoft · edge20 Ara 2016

  • CVE-2016-7288
    51Planlayın

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi

    YüksekCVSS 7,5Kavram kanıtıEPSS %70

    microsoft · edge20 Ara 2016

  • CVE-2016-7289
    39İzleyin

    Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte

    YüksekCVSS 7,8İstismar yokEPSS %25

    microsoft · publisher20 Ara 2016

  • CVE-2016-7290
    35İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on Share

    YüksekCVSS 7,1İstismar yokEPSS %22

    microsoft · office20 Ara 2016

  • CVE-2016-7291
    35İzleyin

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on Share

    YüksekCVSS 7,1İstismar yokEPSS %22

    microsoft · office20 Ara 2016

  • CVE-2016-7296
    35İzleyin

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge20 Ara 2016

  • CVE-2016-7297
    38İzleyin

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi

    YüksekCVSS 7,5İstismar yokEPSS %26

    microsoft · edge20 Ara 2016

  • CVE-2016-7298
    38İzleyin

    Microsoft Office 2007 SP3, Office 2010 SP2, Word Viewer, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to execute arbi

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · office20 Ara 2016

  • CVE-2016-7276
    36İzleyin

    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain s

    YüksekCVSS 7,1İstismar yokEPSS %25

    microsoft · office20 Ara 2016

  • CVE-2016-7456
    60Bu hafta

    VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for rem

    KritikCVSS 9,8SilahlaştırılmışEPSS %32

    vmware · vsphere data protection29 Ara 2016

  • CVE-2016-10033
    99Hemen

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    phpmailer project · phpmailer30 Ara 2016

  • CVE-2016-10034
    51Planlayın

    The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framew

    KritikCVSS 9,8Kavram kanıtıEPSS %38

    zend · zend framework30 Ara 2016

  • CVE-2016-10045
    68Bu hafta

    The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently e

    KritikCVSS 9,8SilahlaştırılmışEPSS %97

    phpmailer project · phpmailer30 Ara 2016

  • CVE-2016-10074
    52Planlayın

    The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    swiftmailer · swiftmailer30 Ara 2016