İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2017: sömürülen ve yeni ciddi CVE kayıtları

59 kayıt · 13 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2017-5943
    35İzleyin

    Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information

    YüksekCVSS 8,8İstismar yokEPSS %0

    bestpractical · request tracker3 Tem 2017

  • CVE-2017-9248
    92Hemen

    Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Te

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %75

    progress · sitefinity3 Tem 2017

  • CVE-2017-10974
    54Planlayın

    Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080.

    YüksekCVSS 7,5Kavram kanıtıEPSS %81

    yaws · yaws7 Tem 2017

  • CVE-2017-9791
    99Hemen

    The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message t

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    apache · struts10 Tem 2017

  • CVE-2017-0243
    37İzleyin

    Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote

    YüksekCVSS 7,8İstismar yokEPSS %21

    microsoft · business productivity servers11 Tem 2017

  • CVE-2017-8463
    37İzleyin

    Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · windows 1011 Tem 2017

  • CVE-2017-8501
    38İzleyin

    Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · excel11 Tem 2017

  • CVE-2017-8502
    38İzleyin

    Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory

    YüksekCVSS 7,8İstismar yokEPSS %23

    microsoft · excel11 Tem 2017

  • CVE-2017-8565
    38İzleyin

    Windows PowerShell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windo

    YüksekCVSS 8,1İstismar yokEPSS %18

    microsoft · windows 1011 Tem 2017

  • CVE-2017-8570
    88Hemen

    Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %89

    microsoft · office11 Tem 2017

  • CVE-2017-8588
    33İzleyin

    Microsoft WordPad in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Window

    YüksekCVSS 7,0İstismar yokEPSS %17

    microsoft · windows 1011 Tem 2017

  • CVE-2017-8589
    47Planlayın

    Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 15

    KritikCVSS 9,8İstismar yokEPSS %26

    microsoft · windows 1011 Tem 2017

  • CVE-2017-8594
    45Planlayın

    Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in th

    YüksekCVSS 7,5Kavram kanıtıEPSS %50

    microsoft · internet explorer11 Tem 2017

  • CVE-2017-8601
    50Planlayın

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in th

    YüksekCVSS 7,5Kavram kanıtıEPSS %66

    microsoft · edge11 Tem 2017

  • CVE-2017-8611
    29İzleyin

    Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote attackers to spoof web content via

    OrtaCVSS 6,5İstismar yokEPSS %11

    microsoft · edge11 Tem 2017

  • CVE-2017-8617
    33İzleyin

    Microsoft Edge in Windows 10 1703 Microsoft Edge allows a remote code execution vulnerability in the way affected Microsoft scripting engine

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · edge11 Tem 2017

  • CVE-2017-8618
    47Planlayın

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window

    YüksekCVSS 7,5Kavram kanıtıEPSS %58

    microsoft · internet explorer11 Tem 2017

  • CVE-2017-8619
    35İzleyin

    Microsoft Edge on Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way aff

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge11 Tem 2017

  • CVE-2017-11165
    58Planlayın

    dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for th

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    thermofisher · dt80 dex firmware12 Tem 2017

  • CVE-2017-7529
    49Planlayın

    Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultin

    YüksekCVSS 7,5Kavram kanıtıEPSS %62

    f5 · nginx13 Tem 2017

  • CVE-2017-9787
    33İzleyin

    When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.

    YüksekCVSS 7,5İstismar yokEPSS %10

    apache · struts13 Tem 2017

  • CVE-2017-9788
    53Planlayın

    In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initi

    KritikCVSS 9,1İstismar yokEPSS %56

    apache · http server13 Tem 2017

  • CVE-2017-0028
    45Planlayın

    A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory.

    KritikCVSS 9,8İstismar yokEPSS %18

    microsoft · edge17 Tem 2017

  • CVE-2017-0152
    35İzleyin

    A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Micros

    YüksekCVSS 8,1İstismar yokEPSS %10

    microsoft · edge17 Tem 2017

  • CVE-2017-0196
    31İzleyin

    An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process m

    OrtaCVSS 6,5İstismar yokEPSS %18

    microsoft · edge17 Tem 2017

  • CVE-2017-1000002
    60Bu hafta

    ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting

    KritikCVSS 9,8SilahlaştırılmışEPSS %30

    atutor · atutor17 Tem 2017

  • CVE-2017-1000028
    60Bu hafta

    Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability,

    YüksekCVSS 7,5SilahlaştırılmışEPSS %99

    oracle · glassfish server17 Tem 2017

  • CVE-2017-11346
    52Planlayın

    Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    zohocorp · manageengine desktop central17 Tem 2017

  • CVE-2017-8011
    43Planlayın

    EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX

    KritikCVSS 9,8İstismar yokEPSS %14

    dell · emc m\&r17 Tem 2017

  • CVE-2017-6736
    86Hemen

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %70

    cisco · ios17 Tem 2017

  • CVE-2017-6737
    79Bu hafta

    A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %45

    cisco · ios17 Tem 2017

  • CVE-2017-6738
    68Bu hafta

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %10

    cisco · ios17 Tem 2017

  • CVE-2017-6739
    68Bu hafta

    A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %10

    cisco · ios17 Tem 2017

  • CVE-2017-6740
    68Bu hafta

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %11

    cisco · ios17 Tem 2017

  • CVE-2017-6742
    71Bu hafta

    A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %21

    cisco · ios17 Tem 2017

  • CVE-2017-6743
    68Bu hafta

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %10

    cisco · ios17 Tem 2017

  • CVE-2017-6744
    67Bu hafta

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %7

    cisco · ios17 Tem 2017

  • CVE-2017-9811
    42Planlayın

    The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critic

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    kaspersky · anti-virus for linux server17 Tem 2017

  • CVE-2017-9812
    33İzleyin

    The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    kaspersky · anti-virus for linux server17 Tem 2017

  • CVE-2017-11403
    43Planlayın

    The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a c

    YüksekCVSS 8,8İstismar yokEPSS %28

    graphicsmagick · graphicsmagick17 Tem 2017

  • CVE-2017-6320
    38İzleyin

    A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    barracuda · load balancer adc18 Tem 2017

  • CVE-2017-11435
    42Planlayın

    The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the managem

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    humaxdigital · hg100r firmware19 Tem 2017

  • CVE-2017-11444
    43Planlayın

    Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    intelliants · subrion cms19 Tem 2017

  • CVE-2017-11467
    61Bu hafta

    OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attacke

    KritikCVSS 9,8SilahlaştırılmışEPSS %73

    orientdb · orientdb19 Tem 2017

  • CVE-2017-9765
    39İzleyin

    Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows

    YüksekCVSS 8,1İstismar yokEPSS %24

    genivia · gsoap19 Tem 2017

  • CVE-2017-6316
    91Hemen

    Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %73

    citrix · netscaler sd-wan20 Tem 2017

  • CVE-2017-9822
    93Hemen

    DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN site

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %94

    dnnsoftware · dotnetnuke20 Tem 2017

  • CVE-2017-11517
    60Bu hafta

    Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute a

    KritikCVSS 9,8SilahlaştırılmışEPSS %29

    geutebrueck · gcore21 Tem 2017

  • CVE-2017-9554
    60Bu hafta

    An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers

    OrtaCVSS 5,3SilahlaştırılmışEPSS %76

    synology · diskstation manager24 Tem 2017

  • CVE-2015-2279
    44Planlayın

    cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    airlive · bu-2015 firmware24 Tem 2017

  • CVE-2015-2280
    40Planlayın

    snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows re

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    airlink101 · skyipcam1620w wireless n mpeg4 3gpp firmware24 Tem 2017

  • CVE-2016-10401
    39İzleyin

    ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root accou

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    zyxel · pk5001z firmware25 Tem 2017

  • CVE-2017-7659
    46Planlayın

    A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash

    YüksekCVSS 7,5İstismar yokEPSS %53

    apache · http server26 Tem 2017

  • CVE-2017-8869
    40Planlayın

    Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %15

    mediacoder · mediacoder27 Tem 2017

  • CVE-2016-10402
    34İzleyin

    Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large r

    YüksekCVSS 7,8İstismar yokEPSS %10

    avira · antivirus27 Tem 2017

  • CVE-2017-8870
    40Planlayın

    Buffer overflow in AudioCoder 0.8.46 allows remote attackers to execute arbitrary code via a crafted .m3u file.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %13

    mediacoderhq · audiocoder27 Tem 2017

  • CVE-2016-0736
    45Planlayın

    In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly

    YüksekCVSS 7,5Kavram kanıtıEPSS %49

    apache · http server27 Tem 2017

  • CVE-2016-2161
    36İzleyin

    In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continue

    YüksekCVSS 7,5İstismar yokEPSS %20

    apache · http server27 Tem 2017

  • CVE-2016-8743
    34İzleyin

    Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response li

    YüksekCVSS 7,5İstismar yokEPSS %13

    apache · http server27 Tem 2017