İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2017: sömürülen ve yeni ciddi CVE kayıtları

50 kayıt · 2 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2017-16352
    39İzleyin

    GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of t

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    graphicsmagick · graphicsmagick1 Kas 2017

  • CVE-2017-16353
    30İzleyin

    GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/descr

    OrtaCVSS 6,5Kavram kanıtıEPSS %13

    graphicsmagick · graphicsmagick1 Kas 2017

  • CVE-2017-12243
    54Planlayın

    A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco

    YüksekCVSS 7,8Kavram kanıtıEPSS %77

    cisco · unified computing system manager firmware2 Kas 2017

  • CVE-2017-3736
    29İzleyin

    There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g.

    OrtaCVSS 6,5İstismar yokEPSS %10

    openssl · openssl2 Kas 2017

  • CVE-2017-16524
    44Planlayın

    Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows re

    YüksekCVSS 8,8SilahlaştırılmışEPSS %30

    samsung · srn-1670d6 Kas 2017

  • CVE-2017-14016
    60Bu hafta

    A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.

    OrtaCVSS 6,3SilahlaştırılmışEPSS %16

    advantech · webaccess6 Kas 2017

  • CVE-2017-2893
    37İzleyin

    An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.

    YüksekCVSS 7,5İstismar yokEPSS %24

    cesanta · mongoose7 Kas 2017

  • CVE-2017-2894
    48Planlayın

    An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.

    KritikCVSS 9,8İstismar yokEPSS %31

    cesanta · mongoose7 Kas 2017

  • CVE-2017-16642
    38İzleyin

    In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' a

    YüksekCVSS 7,5Kavram kanıtıEPSS %26

    php · php7 Kas 2017

  • CVE-2017-11512
    54Planlayın

    The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the nam

    YüksekCVSS 7,5Kavram kanıtıEPSS %79

    manageengine · servicedesk8 Kas 2017

  • CVE-2017-16651
    75Bu hafta

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's file

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %45

    roundcube · webmail9 Kas 2017

  • CVE-2015-7501
    65Bu hafta

    Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Appli

    KritikCVSS 9,8Kavram kanıtıEPSS %85

    redhat · data grid9 Kas 2017

  • CVE-2017-12969
    38İzleyin

    Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to c

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    avaya · ip office contact center9 Kas 2017

  • CVE-2017-16249
    60Bu hafta

    The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the se

    YüksekCVSS 7,5SilahlaştırılmışEPSS %59

    brother · dcp-j132w firmware9 Kas 2017

  • CVE-2017-16562
    47Planlayın

    The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentic

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    userproplugin · userpro9 Kas 2017

  • CVE-2017-16780
    41Planlayın

    The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.

    KritikCVSS 9,8Kavram kanıtıEPSS %5

    mybb · mybb10 Kas 2017

  • CVE-2017-16806
    60Bu hafta

    The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %91

    ulterius · ulterius server13 Kas 2017

  • CVE-2016-8610
    42Planlayın

    A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processi

    YüksekCVSS 7,5Kavram kanıtıEPSS %39

    openssl · openssl13 Kas 2017

  • CVE-2017-12635
    69Bu hafta

    Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x b

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    apache · couchdb14 Kas 2017

  • CVE-2017-12636
    55Planlayın

    CouchDB administrative users can configure the database server via HTTP(S).

    YüksekCVSS 7,2SilahlaştırılmışEPSS %90

    apache · couchdb14 Kas 2017

  • CVE-2017-11834
    25İzleyin

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    OrtaCVSS 5,3İstismar yokEPSS %12

    microsoft · internet explorer14 Kas 2017

  • CVE-2017-11839
    49Planlayın

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take c

    YüksekCVSS 7,5Kavram kanıtıEPSS %62

    microsoft · edge14 Kas 2017

  • CVE-2017-11840
    48Planlayın

    ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an att

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    microsoft · chakracore14 Kas 2017

  • CVE-2017-11841
    48Planlayın

    ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an att

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    microsoft · chakracore14 Kas 2017

  • CVE-2017-11853
    25İzleyin

    Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607

    OrtaCVSS 5,5İstismar yokEPSS %10

    microsoft · windows 1014 Kas 2017

  • CVE-2017-11855
    45Planlayın

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    YüksekCVSS 7,5Kavram kanıtıEPSS %48

    microsoft · internet explorer14 Kas 2017

  • CVE-2017-11861
    49Planlayın

    Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user

    YüksekCVSS 7,5Kavram kanıtıEPSS %64

    microsoft · chakracore14 Kas 2017

  • CVE-2017-11870
    48Planlayın

    ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    microsoft · chakracore14 Kas 2017

  • CVE-2017-11873
    51Planlayın

    ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker

    YüksekCVSS 7,5Kavram kanıtıEPSS %69

    microsoft · chakracore14 Kas 2017

  • CVE-2017-11882
    91Hemen

    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %99

    microsoft · office14 Kas 2017

  • CVE-2017-8700
    33İzleyin

    ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restric

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · asp.net core14 Kas 2017

  • CVE-2017-15806
    35İzleyin

    The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters use

    YüksekCVSS 8,1Kavram kanıtıEPSS %10

    zetacomponents · mail15 Kas 2017

  • CVE-2017-16844
    43Planlayın

    Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of ser

    KritikCVSS 9,8İstismar yokEPSS %12

    procmail · procmail16 Kas 2017

  • CVE-2017-16846
    44Planlayın

    Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid par

    KritikCVSS 9,8İstismar yokEPSS %16

    zohocorp · manageengine applications manager16 Kas 2017

  • CVE-2017-16847
    44Planlayın

    Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPla

    KritikCVSS 9,8İstismar yokEPSS %16

    zohocorp · manageengine applications manager16 Kas 2017

  • CVE-2017-16848
    44Planlayın

    Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.

    KritikCVSS 9,8İstismar yokEPSS %15

    zohocorp · manageengine applications manager16 Kas 2017

  • CVE-2017-16849
    44Planlayın

    Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.

    KritikCVSS 9,8İstismar yokEPSS %16

    zohocorp · manageengine applications manager16 Kas 2017

  • CVE-2017-16850
    44Planlayın

    Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getReso

    KritikCVSS 9,8İstismar yokEPSS %16

    zohocorp · manageengine applications manager16 Kas 2017

  • CVE-2017-16851
    44Planlayın

    Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter.

    KritikCVSS 9,8İstismar yokEPSS %16

    zohocorp · manageengine applications manager16 Kas 2017

  • CVE-2017-16877
    34İzleyin

    ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive inf

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    zeit · next.js17 Kas 2017

  • CVE-2017-1000170
    48Planlayın

    jqueryFileTree 2.1.5 and older Directory Traversal

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    jqueryfiletree project · jqueryfiletree17 Kas 2017

  • CVE-2017-6168
    60Bu hafta

    On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3)

    YüksekCVSS 7,4SilahlaştırılmışEPSS %19

    f5 · big-ip ltm17 Kas 2017

  • CVE-2017-16894
    60Bu hafta

    In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct re

    YüksekCVSS 7,5SilahlaştırılmışEPSS %86

    laravel · laravel19 Kas 2017

  • CVE-2017-16934
    43Planlayın

    The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.ht

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    dbltek · web server24 Kas 2017

  • CVE-2017-16943
    53Planlayın

    The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a

    KritikCVSS 9,8Kavram kanıtıEPSS %47

    exim · exim25 Kas 2017

  • CVE-2017-16944
    49Planlayın

    The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinit

    YüksekCVSS 7,5Kavram kanıtıEPSS %63

    exim · exim25 Kas 2017

  • CVE-2017-15275
    36İzleyin

    Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap

    YüksekCVSS 7,5İstismar yokEPSS %21

    samba · samba27 Kas 2017

  • CVE-2017-17058
    37İzleyin

    The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/ema

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    automattic · woocommerce29 Kas 2017

  • CVE-2017-13872
    60Bu hafta

    An issue was discovered in certain Apple products.

    YüksekCVSS 8,1SilahlaştırılmışEPSS %36

    apple · mac os x29 Kas 2017

  • CVE-2017-8817
    42Planlayın

    The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and app

    KritikCVSS 9,8İstismar yokEPSS %11

    haxx · curl29 Kas 2017