İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2017: sömürülen ve yeni ciddi CVE kayıtları

100 kayıt · 13 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2017-14103
    44Planlayın

    The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain

    YüksekCVSS 8,8İstismar yokEPSS %30

    graphicsmagick · graphicsmagick1 Eyl 2017

  • CVE-2017-3897
    43Planlayın

    A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    mcafee · livesafe1 Eyl 2017

  • CVE-2017-14098
    45Planlayın

    In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, o

    YüksekCVSS 7,5İstismar yokEPSS %50

    digium · asterisk2 Eyl 2017

  • CVE-2017-14100
    43Planlayın

    In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before

    KritikCVSS 9,8İstismar yokEPSS %14

    digium · asterisk2 Eyl 2017

  • CVE-2017-14117
    25İzleyin

    The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenti

    OrtaCVSS 5,9SilahlaştırılmışEPSS %8

    att · u-verse firmware3 Eyl 2017

  • CVE-2017-14135
    46Planlayın

    enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execut

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    dreambox · opendreambox4 Eyl 2017

  • CVE-2017-1000083
    46Planlayın

    backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary com

    YüksekCVSS 7,8SilahlaştırılmışEPSS %51

    gnome · evince5 Eyl 2017

  • CVE-2017-1129
    35İzleyin

    IBM Notes 8.5 and 9.0 is vulnerable to a denial of service.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %30

    ibm · inotes5 Eyl 2017

  • CVE-2017-1130
    35İzleyin

    IBM Notes 8.5 and 9.0 is vulnerable to a denial of service.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %29

    ibm · inotes5 Eyl 2017

  • CVE-2015-7241
    43Planlayın

    XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    sap · netweaver6 Eyl 2017

  • CVE-2017-12794
    31İzleyin

    In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 d

    OrtaCVSS 6,1Kavram kanıtıEPSS %23

    djangoproject · django7 Eyl 2017

  • CVE-2017-14147
    59Planlayın

    An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a route

    KritikCVSS 9,8Kavram kanıtıEPSS %65

    fiberhome · adsl an1020-25 firmware7 Eyl 2017

  • CVE-2017-6627
    62Bu hafta

    A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, re

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %6

    cisco · ios7 Eyl 2017

  • CVE-2015-8351
    47Planlayın

    PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows

    KritikCVSS 9,0Kavram kanıtıEPSS %37

    gwolle guestbook project · gwolle guestbook11 Eyl 2017

  • CVE-2017-3133
    27İzleyin

    A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or command

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    fortinet · fortios11 Eyl 2017

  • CVE-2017-14335
    38İzleyin

    On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Securi

    YüksekCVSS 7,5Kavram kanıtıEPSS %27

    hbgk · hb7024xt firmware12 Eyl 2017

  • CVE-2017-1000251
    37İzleyin

    The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vuln

    YüksekCVSS 8,0Kavram kanıtıEPSS %16

    linux · linux kernel12 Eyl 2017

  • CVE-2017-0161
    35İzleyin

    The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a

    YüksekCVSS 8,1İstismar yokEPSS %11

    microsoft · windows 1012 Eyl 2017

  • CVE-2017-11764
    49Planlayın

    Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of th

    YüksekCVSS 7,5Kavram kanıtıEPSS %64

    microsoft · edge12 Eyl 2017

  • CVE-2017-8567
    37İzleyin

    A remote code execution vulnerability exists in Microsoft Excel for Mac 2011 when it fails to properly handle objects in memory, aka "Micros

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · excel for mac12 Eyl 2017

  • CVE-2017-8630
    37İzleyin

    Microsoft Office 2016 allows a remote code execution vulnerability when it fails to properly handle objects in memory, aka "Microsoft Office

    YüksekCVSS 7,8İstismar yokEPSS %21

    microsoft · office12 Eyl 2017

  • CVE-2017-8631
    36İzleyin

    A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Mi

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · excel12 Eyl 2017

  • CVE-2017-8632
    36İzleyin

    A remote code execution vulnerability exists in Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 20

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · excel12 Eyl 2017

  • CVE-2017-8660
    38İzleyin

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    YüksekCVSS 8,8İstismar yokEPSS %10

    microsoft · edge12 Eyl 2017

  • CVE-2017-8676
    17İzleyin

    The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012

    DüşükCVSS 3,3İstismar yokEPSS %14

    microsoft · live meeting12 Eyl 2017

  • CVE-2017-8682
    50Planlayın

    Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.

    YüksekCVSS 8,8Kavram kanıtıEPSS %49

    microsoft · office 200712 Eyl 2017

  • CVE-2017-8683
    29İzleyin

    Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.

    OrtaCVSS 5,5Kavram kanıtıEPSS %22

    microsoft · windows 1012 Eyl 2017

  • CVE-2017-8686
    47Planlayın

    The Windows Server DHCP service in Windows Server 2012 Gold and R2, and Windows Server 2016 allows an attacker to either run arbitrary code

    KritikCVSS 9,8İstismar yokEPSS %27

    microsoft · windows server 201212 Eyl 2017

  • CVE-2017-8692
    35İzleyin

    The Windows Uniscribe component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · windows 1012 Eyl 2017

  • CVE-2017-8696
    34İzleyin

    Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · live meeting12 Eyl 2017

  • CVE-2017-8699
    34İzleyin

    Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window

    YüksekCVSS 7,0İstismar yokEPSS %21

    microsoft · windows 1012 Eyl 2017

  • CVE-2017-8710
    25İzleyin

    The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbit

    OrtaCVSS 5,5İstismar yokEPSS %10

    microsoft · windows 712 Eyl 2017

  • CVE-2017-8725
    37İzleyin

    A remote code execution vulnerability exists in Microsoft Publisher 2007 Service Pack 3 and Microsoft Publisher 2010 Service Pack 2 when the

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · publisher12 Eyl 2017

  • CVE-2017-8728
    36İzleyin

    Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, an

    YüksekCVSS 7,5İstismar yokEPSS %21

    microsoft · windows 8.112 Eyl 2017

  • CVE-2017-8729
    52Planlayın

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way

    YüksekCVSS 7,5Kavram kanıtıEPSS %72

    microsoft · edge12 Eyl 2017

  • CVE-2017-8731
    45Planlayın

    Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curre

    YüksekCVSS 7,5Kavram kanıtıEPSS %51

    microsoft · edge12 Eyl 2017

  • CVE-2017-8734
    46Planlayın

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the c

    YüksekCVSS 7,5Kavram kanıtıEPSS %52

    microsoft · edge12 Eyl 2017

  • CVE-2017-8737
    36İzleyin

    Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, an

    YüksekCVSS 7,5İstismar yokEPSS %21

    microsoft · edge12 Eyl 2017

  • CVE-2017-8740
    52Planlayın

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way

    YüksekCVSS 7,5Kavram kanıtıEPSS %72

    microsoft · edge12 Eyl 2017

  • CVE-2017-8741
    34İzleyin

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    YüksekCVSS 7,5İstismar yokEPSS %11

    microsoft · edge12 Eyl 2017

  • CVE-2017-8742
    38İzleyin

    A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, Microsof

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · office compatibility pack12 Eyl 2017

  • CVE-2017-8743
    38İzleyin

    A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016, and Office Online Se

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · office online server12 Eyl 2017

  • CVE-2017-8744
    36İzleyin

    A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Mi

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · office12 Eyl 2017

  • CVE-2017-8747
    33İzleyin

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · internet explorer12 Eyl 2017

  • CVE-2017-8748
    34İzleyin

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Micros

    YüksekCVSS 7,5İstismar yokEPSS %11

    microsoft · edge12 Eyl 2017

  • CVE-2017-8749
    33İzleyin

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · internet explorer12 Eyl 2017

  • CVE-2017-8751
    45Planlayın

    Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way tha

    YüksekCVSS 7,5Kavram kanıtıEPSS %50

    microsoft · edge12 Eyl 2017

  • CVE-2017-8755
    51Planlayın

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    YüksekCVSS 7,5Kavram kanıtıEPSS %71

    microsoft · edge12 Eyl 2017

  • CVE-2017-8757
    35İzleyin

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the c

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge12 Eyl 2017

  • CVE-2017-8759
    88Hemen

    Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious docume

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %88

    microsoft · .net framework12 Eyl 2017

  • CVE-2017-1002000
    47Planlayın

    Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    mobile-friendly-app-builder-by-easytouch project · mobile-friendly-app-builder-by-easytouch14 Eyl 2017

  • CVE-2017-1002001
    42Planlayın

    Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://w

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    mobile-app-builder-by-wappress project · mobile-app-builder-by-wappress14 Eyl 2017

  • CVE-2017-1002002
    43Planlayın

    Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    webapp-builder project · webapp-builder14 Eyl 2017

  • CVE-2017-1002003
    43Planlayın

    Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software fr

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    wp2android-turn-wp-site-into-android-app project · wp2android-turn-wp-site-into-android-app14 Eyl 2017

  • CVE-2017-1002008
    44Planlayın

    Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    membership simplified project · membership simplified14 Eyl 2017

  • CVE-2017-13067
    44Planlayın

    QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and

    KritikCVSS 9,8SilahlaştırılmışEPSS %16

    qnap · qts14 Eyl 2017

  • CVE-2017-0781
    42Planlayın

    A remote code execution vulnerability in the Android system (bluetooth).

    YüksekCVSS 8,8Kavram kanıtıEPSS %22

    google · android14 Eyl 2017

  • CVE-2017-0785
    30İzleyin

    A information disclosure vulnerability in the Android system (bluetooth).

    OrtaCVSS 6,5Kavram kanıtıEPSS %12

    google · android14 Eyl 2017

  • CVE-2017-9805
    92Hemen

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %99

    apache · struts15 Eyl 2017

  • CVE-2014-9463
    39İzleyin

    functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    vbseo · vbseo15 Eyl 2017

  • CVE-2017-14502
    31İzleyin

    read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, lead

    YüksekCVSS 7,5İstismar yokEPSS %3

    libarchive · libarchive17 Eyl 2017

  • CVE-2017-14243
    43Planlayın

    An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    utstar · wa3002g4 firmware17 Eyl 2017

  • CVE-2017-14244
    44Planlayın

    An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directl

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    iball · ib-wra150n firmware17 Eyl 2017

  • CVE-2017-9798
    58Planlayın

    Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o

    YüksekCVSS 7,5SilahlaştırılmışEPSS %94

    apache · http server18 Eyl 2017

  • CVE-2017-12615
    92Hemen

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %99

    apache · tomcat19 Eyl 2017

  • CVE-2014-9611
    43Planlayın

    Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmi

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    netsweeper · netsweeper19 Eyl 2017

  • CVE-2014-9618
    61Bu hafta

    The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass aut

    KritikCVSS 9,8Kavram kanıtıEPSS %72

    netsweeper · netsweeper19 Eyl 2017

  • CVE-2017-14143
    62Bu hafta

    The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote at

    KritikCVSS 9,8SilahlaştırılmışEPSS %77

    kaltura · kaltura server19 Eyl 2017

  • CVE-2017-10784
    40Planlayın

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers t

    YüksekCVSS 8,8İstismar yokEPSS %16

    ruby-lang · ruby19 Eyl 2017

  • CVE-2017-6315
    44Planlayın

    Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx.

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    sophos · astaro security gateway firmware19 Eyl 2017

  • CVE-2017-12616
    51Planlayın

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code

    YüksekCVSS 7,5İstismar yokEPSS %70

    apache · tomcat19 Eyl 2017

  • CVE-2014-8684
    61Bu hafta

    CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and

    KritikCVSS 9,8SilahlaştırılmışEPSS %71

    codeigniter · codeigniter19 Eyl 2017

  • CVE-2014-8686
    50Planlayın

    CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption sch

    KritikCVSS 9,8SilahlaştırılmışEPSS %37

    codeigniter · codeigniter19 Eyl 2017

  • CVE-2017-8770
    33İzleyin

    There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device vi

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    twsz · wifi repeater firmware20 Eyl 2017

  • CVE-2015-4074
    47Planlayın

    Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a

    YüksekCVSS 7,5Kavram kanıtıEPSS %56

    helpdesk pro project · helpdesk pro20 Eyl 2017

  • CVE-2017-7924
    37İzleyin

    An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB,

    YüksekCVSS 7,5SilahlaştırılmışEPSS %22

    rockwellautomation · 1763-l16bwa firmware20 Eyl 2017

  • CVE-2017-12611
    65Bu hafta

    In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string lite

    KritikCVSS 9,8Kavram kanıtıEPSS %87

    apache · struts20 Eyl 2017

  • CVE-2015-2826
    25İzleyin

    WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.

    OrtaCVSS 5,3Kavram kanıtıEPSS %12

    simple ads manager project · simple ads manager20 Eyl 2017

  • CVE-2015-1187
    94Hemen

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.c

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %82

    trendnet · tew-731br firmware21 Eyl 2017

  • CVE-2017-12929
    38İzleyin

    Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    tecnovision · dlx spot player421 Eyl 2017

  • CVE-2017-11395
    39İzleyin

    Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers wi

    YüksekCVSS 8,8İstismar yokEPSS %14

    trendmicro · smart protection server22 Eyl 2017

  • CVE-2017-14078
    54Planlayın

    SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbi

    KritikCVSS 9,8İstismar yokEPSS %50

    trendmicro · mobile security22 Eyl 2017

  • CVE-2017-14079
    38İzleyin

    Unrestricted file uploads in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrar

    YüksekCVSS 8,8İstismar yokEPSS %10

    trendmicro · mobile security22 Eyl 2017

  • CVE-2017-14081
    40Planlayın

    Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to ex

    YüksekCVSS 8,8İstismar yokEPSS %16

    trendmicro · mobile security22 Eyl 2017

  • CVE-2017-14706
    47Planlayın

    DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /w

    KritikCVSS 9,8SilahlaştırılmışEPSS %28

    denyall · i-suite22 Eyl 2017

  • CVE-2017-14627
    37İzleyin

    Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INF

    YüksekCVSS 7,8SilahlaştırılmışEPSS %19

    cyberlink · labelprint23 Eyl 2017

  • CVE-2017-14719
    34İzleyin

    Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    wordpress · wordpress23 Eyl 2017

  • CVE-2015-4667
    42Planlayın

    Multiple hardcoded credentials in Xsuite 2.x.

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    xceedium · xsuite25 Eyl 2017

  • CVE-2015-8249
    61Bu hafta

    The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary fil

    KritikCVSS 9,8SilahlaştırılmışEPSS %73

    manageengine · desktop central27 Eyl 2017

  • CVE-2017-14849
    46Planlayın

    Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the p

    YüksekCVSS 7,5Kavram kanıtıEPSS %54

    nodejs · node.js27 Eyl 2017

  • CVE-2017-12231
    62Bu hafta

    A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unaut

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Eyl 2017

  • CVE-2017-12232
    57Planlayın

    A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %2

    cisco · ios28 Eyl 2017

  • CVE-2017-12233
    62Bu hafta

    Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Eyl 2017

  • CVE-2017-12234
    62Bu hafta

    Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Eyl 2017

  • CVE-2017-12235
    62Bu hafta

    A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could al

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Eyl 2017

  • CVE-2017-12237
    62Bu hafta

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Eyl 2017

  • CVE-2017-12238
    57Planlayın

    A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %2

    cisco · ios28 Eyl 2017

  • CVE-2017-12240
    73Bu hafta

    The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticat

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %13

    cisco · ios28 Eyl 2017

  • CVE-2017-14867
    46Planlayın

    Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to su

    YüksekCVSS 8,8İstismar yokEPSS %36

    git-scm · git28 Eyl 2017

  • CVE-2017-14942
    57Planlayın

    Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct reques

    KritikCVSS 9,8Kavram kanıtıEPSS %60

    intelbras · wrn 150 firmware29 Eyl 2017