İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2017: sömürülen ve yeni ciddi CVE kayıtları

71 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2016-10105
    40Planlayın

    admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files.

    KritikCVSS 9,8İstismar yokEPSS %2

    piwigo · piwigo3 Oca 2017

  • CVE-2016-10107
    42Planlayın

    Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie hea

    KritikCVSS 9,8İstismar yokEPSS %11

    western digital · mycloud nas3 Oca 2017

  • CVE-2016-10108
    68Bu hafta

    Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modi

    KritikCVSS 9,8SilahlaştırılmışEPSS %97

    western digital · mycloud nas3 Oca 2017

  • CVE-2016-10009
    40Planlayın

    Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKC

    YüksekCVSS 7,3Kavram kanıtıEPSS %37

    openbsd · openssh4 Oca 2017

  • CVE-2016-8334
    19İzleyin

    A large out-of-bounds read on the heap vulnerability in Foxit PDF Reader can potentially be abused for information disclosure.

    DüşükCVSS 3,3İstismar yokEPSS %18

    foxitsoftware · reader6 Oca 2017

  • CVE-2016-8704
    46Planlayın

    An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcac

    KritikCVSS 9,8İstismar yokEPSS %23

    memcached · memcached6 Oca 2017

  • CVE-2016-8705
    45Planlayın

    Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached b

    KritikCVSS 9,8İstismar yokEPSS %19

    memcached · memcached6 Oca 2017

  • CVE-2016-8706
    46Planlayın

    An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary pro

    YüksekCVSS 8,1Kavram kanıtıEPSS %45

    memcached · memcached6 Oca 2017

  • CVE-2017-0002
    39İzleyin

    Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and data: URLs, aka "Micro

    YüksekCVSS 8,8İstismar yokEPSS %14

    microsoft · edge10 Oca 2017

  • CVE-2017-0003
    38İzleyin

    Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafted document, aka "Micr

    YüksekCVSS 7,8İstismar yokEPSS %24

    microsoft · sharepoint enterprise server10 Oca 2017

  • CVE-2017-0004
    57Planlayın

    The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1

    YüksekCVSS 7,5İstismar yokEPSS %91

    microsoft · windows 710 Oca 2017

  • CVE-2017-2930
    43Planlayın

    Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manip

    YüksekCVSS 8,8Kavram kanıtıEPSS %25

    adobe · flash player11 Oca 2017

  • CVE-2017-2931
    41Planlayın

    Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadat

    YüksekCVSS 8,8Kavram kanıtıEPSS %21

    adobe · flash player11 Oca 2017

  • CVE-2017-2932
    42Planlayın

    Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class.

    YüksekCVSS 8,8Kavram kanıtıEPSS %24

    adobe · flash player11 Oca 2017

  • CVE-2017-2933
    44Planlayın

    Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression.

    YüksekCVSS 8,8Kavram kanıtıEPSS %29

    adobe · flash player11 Oca 2017

  • CVE-2017-2934
    44Planlayın

    Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Texture Format files.

    YüksekCVSS 8,8Kavram kanıtıEPSS %29

    adobe · flash player11 Oca 2017

  • CVE-2017-2935
    44Planlayın

    Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container

    YüksekCVSS 8,8Kavram kanıtıEPSS %29

    adobe · flash player11 Oca 2017

  • CVE-2017-2946
    38İzleyin

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vuln

    YüksekCVSS 7,8İstismar yokEPSS %24

    adobe · acrobat11 Oca 2017

  • CVE-2017-2949
    37İzleyin

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vuln

    YüksekCVSS 7,8İstismar yokEPSS %20

    adobe · acrobat11 Oca 2017

  • CVE-2017-2959
    34İzleyin

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vuln

    YüksekCVSS 7,8İstismar yokEPSS %11

    adobe · acrobat11 Oca 2017

  • CVE-2017-2960
    37İzleyin

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption

    YüksekCVSS 7,8İstismar yokEPSS %18

    adobe · acrobat11 Oca 2017

  • CVE-2017-2966
    34İzleyin

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vuln

    YüksekCVSS 7,8İstismar yokEPSS %10

    adobe · acrobat11 Oca 2017

  • CVE-2016-7478
    43Planlayın

    Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infin

    YüksekCVSS 7,5İstismar yokEPSS %42

    php · php11 Oca 2017

  • CVE-2017-5340
    44Planlayın

    Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows rem

    KritikCVSS 9,8İstismar yokEPSS %16

    php · php11 Oca 2017

  • CVE-2016-7480
    51Planlayın

    The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, whic

    KritikCVSS 9,8İstismar yokEPSS %41

    php · php11 Oca 2017

  • CVE-2016-4806
    33İzleyin

    Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access w

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    web2py · web2py11 Oca 2017

  • CVE-2016-7479
    52Planlayın

    In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-af

    KritikCVSS 9,8İstismar yokEPSS %41

    php · php11 Oca 2017

  • CVE-2016-9131
    42Planlayın

    named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of ser

    YüksekCVSS 7,5İstismar yokEPSS %40

    isc · bind12 Oca 2017

  • CVE-2016-9147
    37İzleyin

    named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and d

    YüksekCVSS 7,5İstismar yokEPSS %24

    isc · bind12 Oca 2017

  • CVE-2016-9444
    35İzleyin

    named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of ser

    YüksekCVSS 7,5İstismar yokEPSS %18

    isc · bind12 Oca 2017

  • CVE-2016-9299
    68Bu hafta

    The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized

    KritikCVSS 9,8SilahlaştırılmışEPSS %96

    jenkins · jenkins12 Oca 2017

  • CVE-2015-3188
    43Planlayın

    The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.

    KritikCVSS 9,8İstismar yokEPSS %14

    apache · storm13 Oca 2017

  • CVE-2016-7426
    34İzleyin

    NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allo

    YüksekCVSS 7,5İstismar yokEPSS %12

    ntp · ntp13 Oca 2017

  • CVE-2016-7434
    46Planlayın

    The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.

    YüksekCVSS 7,5Kavram kanıtıEPSS %53

    ntp · ntp13 Oca 2017

  • CVE-2016-9310
    29İzleyin

    The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mo

    OrtaCVSS 6,5İstismar yokEPSS %11

    ntp · ntp13 Oca 2017

  • CVE-2016-9311
    26İzleyin

    ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference

    OrtaCVSS 5,9İstismar yokEPSS %11

    ntp · ntp13 Oca 2017

  • CVE-2016-9312
    40Planlayın

    ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet.

    YüksekCVSS 7,5İstismar yokEPSS %31

    ntp · ntp13 Oca 2017

  • CVE-2016-8205
    43Planlayın

    A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 1

    KritikCVSS 9,8İstismar yokEPSS %13

    brocade · network advisor14 Oca 2017

  • CVE-2016-8206
    34İzleyin

    A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 1

    YüksekCVSS 7,5İstismar yokEPSS %14

    brocade · network advisor14 Oca 2017

  • CVE-2016-8207
    35İzleyin

    A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.

    YüksekCVSS 7,5İstismar yokEPSS %15

    brocade · network advisor14 Oca 2017

  • CVE-2017-5487
    47Planlayın

    wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not prop

    OrtaCVSS 5,3Kavram kanıtıEPSS %87

    wordpress · wordpress14 Oca 2017

  • CVE-2017-5521
    89Hemen

    An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R80

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %89

    netgear · r6200 firmware17 Oca 2017

  • CVE-2016-2233
    40Planlayın

    Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial

    YüksekCVSS 7,5Kavram kanıtıEPSS %34

    hexchat project · hexchat18 Oca 2017

  • CVE-2016-7982
    36İzleyin

    Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on

    YüksekCVSS 7,5Kavram kanıtıEPSS %20

    spip · spip18 Oca 2017

  • CVE-2016-7998
    39İzleyin

    The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    spip · spip18 Oca 2017

  • CVE-2016-6896
    39İzleyin

    Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remo

    YüksekCVSS 7,1Kavram kanıtıEPSS %38

    wordpress · wordpress18 Oca 2017

  • CVE-2016-6897
    60Bu hafta

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef

    OrtaCVSS 6,5SilahlaştırılmışEPSS %28

    wordpress · wordpress18 Oca 2017

  • CVE-2016-5198
    75Bu hafta

    V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect o

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %34

    google · chrome19 Oca 2017

  • CVE-2016-5725
    30İzleyin

    Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP server

    OrtaCVSS 5,9Kavram kanıtıEPSS %24

    jcraft · jsch19 Oca 2017

  • CVE-2016-6253
    40Planlayın

    mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbi

    YüksekCVSS 7,8SilahlaştırılmışEPSS %3

    netbsd · netbsd20 Oca 2017

  • CVE-2016-4010
    67Bu hafta

    Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted

    KritikCVSS 9,8SilahlaştırılmışEPSS %92

    magento · magento23 Oca 2017

  • CVE-2016-4338
    38İzleyin

    The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.

    YüksekCVSS 8,1Kavram kanıtıEPSS %21

    zabbix · zabbix23 Oca 2017

  • CVE-2016-4340
    38İzleyin

    The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 thro

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    gitlab · gitlab23 Oca 2017

  • CVE-2016-6600
    66Bu hafta

    Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to uploa

    KritikCVSS 9,8SilahlaştırılmışEPSS %90

    zohocorp · webnms framework23 Oca 2017

  • CVE-2016-6601
    60Bu hafta

    Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to rea

    YüksekCVSS 7,5SilahlaştırılmışEPSS %97

    zohocorp · webnms framework23 Oca 2017

  • CVE-2016-6602
    60Bu hafta

    ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtai

    KritikCVSS 9,8SilahlaştırılmışEPSS %55

    zohocorp · webnms framework23 Oca 2017

  • CVE-2016-6603
    65Bu hafta

    ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP

    KritikCVSS 9,8Kavram kanıtıEPSS %86

    zohocorp · webnms framework23 Oca 2017

  • CVE-2016-7567
    43Planlayın

    Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    openslp · openslp23 Oca 2017

  • CVE-2017-5495
    36İzleyin

    All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of

    YüksekCVSS 7,5İstismar yokEPSS %18

    quagga · quagga24 Oca 2017

  • CVE-2016-10161
    34İzleyin

    The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remo

    YüksekCVSS 7,5İstismar yokEPSS %13

    php · php24 Oca 2017

  • CVE-2017-3241
    46Planlayın

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI).

    KritikCVSS 9,0Kavram kanıtıEPSS %32

    oracle · jdk27 Oca 2017

  • CVE-2017-3248
    68Bu hafta

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components).

    KritikCVSS 9,8SilahlaştırılmışEPSS %97

    oracle · weblogic server27 Oca 2017

  • CVE-2016-9553
    34İzleyin

    The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative in

    YüksekCVSS 7,2Kavram kanıtıEPSS %19

    sophos · web appliance28 Oca 2017

  • CVE-2016-9554
    36İzleyin

    The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in i

    YüksekCVSS 7,2Kavram kanıtıEPSS %25

    sophos · web appliance28 Oca 2017

  • CVE-2016-10174
    94Hemen

    The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %83

    netgear · d6100 firmware30 Oca 2017

  • CVE-2016-10175
    60Bu hafta

    The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI.

    KritikCVSS 9,8SilahlaştırılmışEPSS %65

    netgear · wnr2000v5 firmware30 Oca 2017

  • CVE-2016-10176
    62Bu hafta

    The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the dev

    KritikCVSS 9,8SilahlaştırılmışEPSS %77

    netgear · wnr2000v5 firmware30 Oca 2017

  • CVE-2017-5611
    42Planlayın

    SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbit

    KritikCVSS 9,8İstismar yokEPSS %10

    wordpress · wordpress30 Oca 2017

  • CVE-2015-7979
    34İzleyin

    NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sen

    YüksekCVSS 7,5İstismar yokEPSS %11

    ntp · ntp30 Oca 2017

  • CVE-2016-2518
    26İzleyin

    The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference v

    OrtaCVSS 5,3İstismar yokEPSS %15

    ntp · ntp30 Oca 2017

  • CVE-2016-6267
    51Planlayın

    SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authe

    YüksekCVSS 8,8SilahlaştırılmışEPSS %54

    trendmicro · smart protection server30 Oca 2017