İçeriğe atla
Noroxi

Yayın tarihine göre

Şubat 2017: sömürülen ve yeni ciddi CVE kayıtları

41 kayıt · 2 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2017-3823
    60Bu hafta

    An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on M

    YüksekCVSS 8,8SilahlaştırılmışEPSS %27

    cisco · activetouch general plugin container1 Şub 2017

  • CVE-2017-5630
    34İzleyin

    PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect,

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    php · pear1 Şub 2017

  • CVE-2016-10150
    42Planlayın

    Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS

    KritikCVSS 9,8İstismar yokEPSS %10

    linux · linux kernel6 Şub 2017

  • CVE-2015-2794
    62Bu hafta

    The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    dnnsoftware · dotnetnuke6 Şub 2017

  • CVE-2016-6175
    45Planlayın

    Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural fo

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    php-gettext project · php-gettext7 Şub 2017

  • CVE-2015-6023
    32İzleyin

    ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypas

    YüksekCVSS 7,3Kavram kanıtıEPSS %10

    netcommwireless · hspa 3g10wve firmware9 Şub 2017

  • CVE-2015-6024
    47Planlayın

    ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated user

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    netcommwireless · hspa 3g10wve firmware9 Şub 2017

  • CVE-2016-2148
    47Planlayın

    Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vecto

    KritikCVSS 9,8İstismar yokEPSS %27

    busybox · busybox9 Şub 2017

  • CVE-2016-9244
    52Planlayın

    A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes

    YüksekCVSS 7,5Kavram kanıtıEPSS %74

    f5 · big-ip local traffic manager9 Şub 2017

  • CVE-2017-3807
    39İzleyin

    A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    cisco · adaptive security appliance software9 Şub 2017

  • CVE-2017-5941
    57Planlayın

    An issue was discovered in the node-serialize package 0.0.4 for Node.js.

    KritikCVSS 9,8Kavram kanıtıEPSS %61

    node-serialize project · node-serialize9 Şub 2017

  • CVE-2016-6210
    60Bu hafta

    sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the us

    OrtaCVSS 5,9SilahlaştırılmışEPSS %88

    openbsd · openssh13 Şub 2017

  • CVE-2016-9343
    43Planlayın

    An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller FRN 16.00 through 21.00 (excluding all firmware

    KritikCVSS 10,0İstismar yokEPSS %10

    rockwellautomation · softlogix 5800 controller firmware13 Şub 2017

  • CVE-2016-9361
    60Bu hafta

    An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions p

    KritikCVSS 9,8SilahlaştırılmışEPSS %20

    moxa · nport 5100 series firmware13 Şub 2017

  • CVE-2017-5146
    60Bu hafta

    An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %9

    carlosgavazzi · vmu-c em firmware13 Şub 2017

  • CVE-2017-5162
    60Bu hafta

    An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter.

    KritikCVSS 9,8SilahlaştırılmışEPSS %12

    binom3 · universal multifunctional electric power quality meter firmware13 Şub 2017

  • CVE-2017-5972
    37İzleyin

    The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connectio

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    linux · linux kernel14 Şub 2017

  • CVE-2017-2984
    40Planlayın

    Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the h264 decoder routine.

    YüksekCVSS 8,8İstismar yokEPSS %18

    adobe · flash player15 Şub 2017

  • CVE-2017-2985
    42Planlayın

    Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class.

    YüksekCVSS 8,8Kavram kanıtıEPSS %21

    adobe · flash player15 Şub 2017

  • CVE-2017-2986
    44Planlayın

    Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec.

    YüksekCVSS 8,8Kavram kanıtıEPSS %30

    adobe · flash player15 Şub 2017

  • CVE-2017-2988
    40Planlayın

    Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection.

    YüksekCVSS 8,8Kavram kanıtıEPSS %18

    adobe · flash player15 Şub 2017

  • CVE-2017-2992
    45Planlayın

    Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header.

    YüksekCVSS 8,8Kavram kanıtıEPSS %32

    adobe · flash player15 Şub 2017

  • CVE-2017-5991
    35İzleyin

    An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465.

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    artifex · mupdf15 Şub 2017

  • CVE-2016-10134
    64Bu hafta

    SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the t

    KritikCVSS 9,8SilahlaştırılmışEPSS %83

    zabbix · zabbix16 Şub 2017

  • CVE-2016-4314
    23İzleyin

    Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arb

    OrtaCVSS 4,9Kavram kanıtıEPSS %12

    wso2 · carbon16 Şub 2017

  • CVE-2016-8652
    37İzleyin

    The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash)

    OrtaCVSS 5,9İstismar yokEPSS %48

    dovecot · dovecot16 Şub 2017

  • CVE-2016-4669
    40Planlayın

    An issue was discovered in certain Apple products.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %3

    apple · iphone os20 Şub 2017

  • CVE-2017-2361
    29İzleyin

    An issue was discovered in certain Apple products.

    OrtaCVSS 6,1Kavram kanıtıEPSS %17

    apple · mac os x20 Şub 2017

  • CVE-2017-2370
    34İzleyin

    An issue was discovered in certain Apple products.

    YüksekCVSS 7,8Kavram kanıtıEPSS %11

    apple · iphone os20 Şub 2017

  • CVE-2017-0038
    47Planlayın

    gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,

    OrtaCVSS 5,5Kavram kanıtıEPSS %82

    microsoft · windows 1020 Şub 2017

  • CVE-2016-9269
    43Planlayın

    Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version

    KritikCVSS 9,9Kavram kanıtıEPSS %13

    trendmicro · interscan web security virtual appliance21 Şub 2017

  • CVE-2016-9682
    46Planlayın

    The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web ad

    KritikCVSS 9,8Kavram kanıtıEPSS %23

    dell · sonicwall secure remote access server22 Şub 2017

  • CVE-2016-9683
    42Planlayın

    The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web admini

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    dell · sonicwall secure remote access server22 Şub 2017

  • CVE-2017-5586
    47Planlayın

    OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    opentext · documentum d222 Şub 2017

  • CVE-2017-6077
    90Hemen

    ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via s

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %68

    netgear · dgn2200 firmware22 Şub 2017

  • CVE-2017-6187
    60Bu hafta

    Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI i

    KritikCVSS 9,8SilahlaştırılmışEPSS %33

    disksavvy · disksavvy enterprise22 Şub 2017

  • CVE-2017-6206
    35İzleyin

    D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware be

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    dlink · websmart dgs-1510 series firmware23 Şub 2017

  • CVE-2017-0037
    86Hemen

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreak

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %80

    microsoft · edge26 Şub 2017

  • CVE-2017-6342
    43Planlayın

    An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-0

    KritikCVSS 9,8İstismar yokEPSS %12

    dahuasecurity · camera firmware27 Şub 2017

  • CVE-2017-6343
    50Planlayın

    The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29,

    YüksekCVSS 8,1İstismar yokEPSS %60

    dahuasecurity · camera firmware27 Şub 2017

  • CVE-2017-5982
    60Bu hafta

    Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (en

    YüksekCVSS 7,5SilahlaştırılmışEPSS %77

    kodi · kodi28 Şub 2017