İçeriğe atla
Noroxi

Yayın tarihine göre

Mart 2017: sömürülen ve yeni ciddi CVE kayıtları

158 kayıt · 17 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2017-0124
    24İzleyin

    Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive

    OrtaCVSS 4,3Kavram kanıtıEPSS %22

    microsoft · windows 716 Mar 2017

  • CVE-2017-0125
    24İzleyin

    Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive

    OrtaCVSS 4,3Kavram kanıtıEPSS %22

    microsoft · windows 716 Mar 2017

  • CVE-2017-0126
    24İzleyin

    Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive

    OrtaCVSS 4,3Kavram kanıtıEPSS %22

    microsoft · windows 716 Mar 2017

  • CVE-2017-0127
    24İzleyin

    Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive

    OrtaCVSS 4,3Kavram kanıtıEPSS %22

    microsoft · windows 716 Mar 2017

  • CVE-2017-0128
    24İzleyin

    Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive

    OrtaCVSS 4,3Kavram kanıtıEPSS %22

    microsoft · windows 716 Mar 2017

  • CVE-2017-0130
    37İzleyin

    The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of serv

    YüksekCVSS 7,5İstismar yokEPSS %23

    microsoft · internet explorer16 Mar 2017

  • CVE-2017-0131
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge16 Mar 2017

  • CVE-2017-0132
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge16 Mar 2017

  • CVE-2017-0133
    38İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %25

    microsoft · edge16 Mar 2017

  • CVE-2017-0134
    38İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %26

    microsoft · edge16 Mar 2017

  • CVE-2017-0136
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge16 Mar 2017

  • CVE-2017-0137
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge16 Mar 2017

  • CVE-2017-0138
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge16 Mar 2017

  • CVE-2017-0140
    25İzleyin

    Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Secu

    OrtaCVSS 4,2İstismar yokEPSS %28

    microsoft · edge16 Mar 2017

  • CVE-2017-0141
    44Planlayın

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %48

    microsoft · edge16 Mar 2017

  • CVE-2017-0143
    93Hemen

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %93

    microsoft · server message block16 Mar 2017

  • CVE-2017-0144
    95Hemen

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    microsoft · server message block16 Mar 2017

  • CVE-2017-0145
    92Hemen

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %89

    microsoft · server message block16 Mar 2017

  • CVE-2017-0146
    92Hemen

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %89

    microsoft · server message block16 Mar 2017

  • CVE-2017-0147
    90Hemen

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    microsoft · windows 10 150716 Mar 2017

  • CVE-2017-0148
    92Hemen

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %99

    microsoft · server message block16 Mar 2017

  • CVE-2017-0149
    74Bu hafta

    Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %29

    microsoft · internet explorer16 Mar 2017

  • CVE-2017-0150
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge16 Mar 2017

  • CVE-2017-0151
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge16 Mar 2017

  • CVE-2017-0154
    20İzleyin

    Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016 does not enforce cross-domain policies, allowing attack

    OrtaCVSS 4,4İstismar yokEPSS %10

    microsoft · internet explorer16 Mar 2017

  • CVE-2014-8722
    34İzleyin

    GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backu

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    get-simple · getsimple cms17 Mar 2017

  • CVE-2015-3884
    40Planlayın

    Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) sch

    YüksekCVSS 8,8SilahlaştırılmışEPSS %14

    qdpm · qdpm17 Mar 2017

  • CVE-2017-6880
    43Planlayın

    Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspeci

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    cerberus · cerberus ftp server17 Mar 2017

  • CVE-2017-3881
    99Hemen

    A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthe

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    cisco · ios17 Mar 2017

  • CVE-2017-5930
    40Planlayın

    The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete

    DüşükCVSS 2,7SilahlaştırılmışEPSS %14

    opensuse · leap20 Mar 2017

  • CVE-2016-6816
    40Planlayın

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the H

    YüksekCVSS 7,1Kavram kanıtıEPSS %39

    apache · tomcat20 Mar 2017

  • CVE-2017-6971
    40Planlayın

    AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    alienvault · ossim22 Mar 2017

  • CVE-2017-7230
    60Bu hafta

    A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET req

    KritikCVSS 9,8SilahlaştırılmışEPSS %13

    disksorter · disk sorter22 Mar 2017

  • CVE-2017-6972
    43Planlayın

    AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl co

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    alienvault · ossim22 Mar 2017

  • CVE-2017-6359
    47Planlayın

    QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vector

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    qnap · qts23 Mar 2017

  • CVE-2017-6360
    59Planlayın

    QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vect

    KritikCVSS 9,8Kavram kanıtıEPSS %66

    qnap · qts23 Mar 2017

  • CVE-2017-6361
    56Planlayın

    QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    qnap · qts23 Mar 2017

  • CVE-2014-7279
    43Planlayın

    The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equipment management a

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    kankunit · konke smart plug firmware23 Mar 2017

  • CVE-2014-8731
    43Planlayın

    PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    phpmemcachedadmin project · phpmemcachedadmin23 Mar 2017

  • CVE-2017-6517
    53Planlayın

    Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the ta

    KritikCVSS 9,8İstismar yokEPSS %46

    microsoft · skype23 Mar 2017

  • CVE-2015-8556
    44Planlayın

    Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.

    KritikCVSS 10,0Kavram kanıtıEPSS %13

    qemu · qemu24 Mar 2017

  • CVE-2017-5869
    45Planlayın

    Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to u

    YüksekCVSS 8,8Kavram kanıtıEPSS %34

    nuxeo · nuxeo24 Mar 2017

  • CVE-2017-5334
    49Planlayın

    Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attacker

    KritikCVSS 9,8İstismar yokEPSS %32

    gnu · gnutls24 Mar 2017

  • CVE-2017-7240
    35İzleyin

    An issue was discovered on Miele Professional PST10 devices.

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    miele professional · pst10 webserver24 Mar 2017

  • CVE-2017-2641
    43Planlayın

    In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    moodle · moodle26 Mar 2017

  • CVE-2017-7269
    99Hemen

    Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows S

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    microsoft · internet information services26 Mar 2017

  • CVE-2017-5850
    35İzleyin

    httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using a

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    openbsd · openbsd27 Mar 2017

  • CVE-2016-10225
    40Planlayın

    The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "roo

    YüksekCVSS 7,8SilahlaştırılmışEPSS %3

    allwinner · linux-3.4-sunxi27 Mar 2017

  • CVE-2017-6542
    46Planlayın

    The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an a

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    putty · putty27 Mar 2017

  • CVE-2016-8749
    42Planlayın

    Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

    KritikCVSS 9,8İstismar yokEPSS %10

    apache · camel28 Mar 2017

  • CVE-2017-7285
    36İzleyin

    A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaus

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    mikrotik · routeros29 Mar 2017

  • CVE-2017-5226
    41Planlayın

    When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push

    KritikCVSS 10,0İstismar yokEPSS %3

    projectatomic · bubblewrap29 Mar 2017

  • CVE-2017-7308
    40Planlayın

    The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data

    YüksekCVSS 7,8SilahlaştırılmışEPSS %17

    linux · linux kernel29 Mar 2017

  • CVE-2017-7310
    47Planlayın

    A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 1

    YüksekCVSS 7,8SilahlaştırılmışEPSS %53

    flexense · diskboss29 Mar 2017

  • CVE-2017-6182
    44Planlayın

    In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remo

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    sophos · web appliance30 Mar 2017

  • CVE-2017-7309
    36İzleyin

    A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inje

    OrtaCVSS 4,8İstismar yokEPSS %57

    mantisbt · mantisbt31 Mar 2017

  • CVE-2014-3931
    78Bu hafta

    fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corru

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %28

    multi-router looking glass project · multi-router looking glass31 Mar 2017

  • CVE-2015-4624
    41Planlayın

    Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %36

    hak5 · wi-fi pineapple firmware31 Mar 2017