İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2019: sömürülen ve yeni ciddi CVE kayıtları

85 kayıt · 6 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2018-14718
    43Planlayın

    FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-

    KritikCVSS 9,8İstismar yokEPSS %12

    fasterxml · jackson-databind2 Oca 2019

  • CVE-2018-14721
    43Planlayın

    FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging

    KritikCVSS 10,0İstismar yokEPSS %10

    fasterxml · jackson-databind2 Oca 2019

  • CVE-2018-19360
    42Planlayın

    FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transp

    KritikCVSS 9,8İstismar yokEPSS %10

    fasterxml · jackson-databind2 Oca 2019

  • CVE-2018-19361
    42Planlayın

    FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clas

    KritikCVSS 9,8İstismar yokEPSS %10

    fasterxml · jackson-databind2 Oca 2019

  • CVE-2018-19362
    42Planlayın

    FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common

    KritikCVSS 9,8İstismar yokEPSS %10

    fasterxml · jackson-databind2 Oca 2019

  • CVE-2018-18264
    51Planlayın

    Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within

    YüksekCVSS 7,5Kavram kanıtıEPSS %70

    kubernetes · dashboard2 Oca 2019

  • CVE-2018-19861
    43Planlayın

    Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request.

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    minishare project · minishare3 Oca 2019

  • CVE-2018-19862
    43Planlayın

    Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request.

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    minishare project · minishare3 Oca 2019

  • CVE-2019-0538
    37İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %20

    microsoft · office8 Oca 2019

  • CVE-2019-0539
    55Planlayın

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5Kavram kanıtıEPSS %82

    microsoft · chakracore8 Oca 2019

  • CVE-2019-0541
    81Hemen

    A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Ex

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %53

    microsoft · internet explorer8 Oca 2019

  • CVE-2019-0543
    62Bu hafta

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %4

    microsoft · windows 10 15078 Oca 2019

  • CVE-2019-0546
    36İzleyin

    A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ construc

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · visual studio 20178 Oca 2019

  • CVE-2019-0547
    60Bu hafta

    A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka

    KritikCVSS 9,8İstismar yokEPSS %71

    microsoft · windows 108 Oca 2019

  • CVE-2019-0566
    41Planlayın

    An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulne

    YüksekCVSS 8,8Kavram kanıtıEPSS %18

    microsoft · edge8 Oca 2019

  • CVE-2019-0567
    54Planlayın

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5Kavram kanıtıEPSS %80

    microsoft · chakracore8 Oca 2019

  • CVE-2019-0568
    51Planlayın

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5Kavram kanıtıEPSS %69

    microsoft · chakracore8 Oca 2019

  • CVE-2019-0571
    36İzleyin

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S

    YüksekCVSS 7,8Kavram kanıtıEPSS %15

    microsoft · windows 108 Oca 2019

  • CVE-2019-0572
    39İzleyin

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S

    YüksekCVSS 7,8Kavram kanıtıEPSS %25

    microsoft · windows 108 Oca 2019

  • CVE-2019-0573
    37İzleyin

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S

    YüksekCVSS 7,8Kavram kanıtıEPSS %20

    microsoft · windows 108 Oca 2019

  • CVE-2019-0574
    37İzleyin

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S

    YüksekCVSS 7,8Kavram kanıtıEPSS %19

    microsoft · windows 108 Oca 2019

  • CVE-2019-0575
    35İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · windows 108 Oca 2019

  • CVE-2019-0576
    36İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · windows 108 Oca 2019

  • CVE-2019-0577
    36İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · windows 108 Oca 2019

  • CVE-2019-0578
    35İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · windows 108 Oca 2019

  • CVE-2019-0579
    36İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · windows 108 Oca 2019

  • CVE-2019-0580
    36İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · windows 108 Oca 2019

  • CVE-2019-0581
    35İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · windows 108 Oca 2019

  • CVE-2019-0582
    35İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %12

    microsoft · office8 Oca 2019

  • CVE-2019-0583
    36İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · windows 108 Oca 2019

  • CVE-2019-0584
    35İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · windows 108 Oca 2019

  • CVE-2019-0585
    42Planlayın

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft W

    YüksekCVSS 8,8İstismar yokEPSS %21

    microsoft · office8 Oca 2019

  • CVE-2019-0586
    44Planlayın

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak

    KritikCVSS 9,8İstismar yokEPSS %15

    microsoft · exchange server8 Oca 2019

  • CVE-2016-9651
    38İzleyin

    A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to e

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    google · chrome9 Oca 2019

  • CVE-2017-15428
    40Planlayın

    Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior

    YüksekCVSS 8,8Kavram kanıtıEPSS %18

    google · chrome9 Oca 2019

  • CVE-2018-16167
    61Bu hafta

    LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

    KritikCVSS 9,8Kavram kanıtıEPSS %74

    jpcert · logontracer9 Oca 2019

  • CVE-2019-5893
    46Planlayın

    Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    nelson-it · open source erp10 Oca 2019

  • CVE-2018-4404
    39İzleyin

    In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %14

    apple · iphone os11 Oca 2019

  • CVE-2017-18357
    34İzleyin

    Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controll

    OrtaCVSS 6,5SilahlaştırılmışEPSS %27

    shopware · shopware15 Oca 2019

  • CVE-2019-6442
    30İzleyin

    An issue was discovered in NTPsec before 1.1.3.

    OrtaCVSS 6,5Kavram kanıtıEPSS %13

    ntpsec · ntpsec16 Oca 2019

  • CVE-2019-6443
    56Planlayın

    An issue was discovered in NTPsec before 1.1.3.

    KritikCVSS 9,1Kavram kanıtıEPSS %66

    ntpsec · ntpsec16 Oca 2019

  • CVE-2019-6444
    50Planlayın

    An issue was discovered in NTPsec before 1.1.3.

    KritikCVSS 9,1Kavram kanıtıEPSS %45

    ntpsec · ntpsec16 Oca 2019

  • CVE-2019-6445
    30İzleyin

    An issue was discovered in NTPsec before 1.1.3.

    OrtaCVSS 6,5Kavram kanıtıEPSS %14

    ntpsec · ntpsec16 Oca 2019

  • CVE-2019-6446
    44Planlayın

    An issue was discovered in NumPy before 1.16.3.

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    numpy · numpy16 Oca 2019

  • CVE-2019-6447
    51Planlayın

    The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute appli

    YüksekCVSS 8,1SilahlaştırılmışEPSS %63

    estrongs · es file explorer file manager16 Oca 2019

  • CVE-2017-3135
    28İzleyin

    Combination of DNS64 and RPZ Can Lead to Crash

    OrtaCVSS 5,9İstismar yokEPSS %17

    isc · bind16 Oca 2019

  • CVE-2017-3136
    26İzleyin

    An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

    OrtaCVSS 5,9İstismar yokEPSS %11

    isc · bind16 Oca 2019

  • CVE-2017-3140
    27İzleyin

    An error processing RPZ rules can cause named to loop endlessly after handling a query

    OrtaCVSS 5,9İstismar yokEPSS %12

    isc · bind16 Oca 2019

  • CVE-2017-3143
    28İzleyin

    An error in TSIG authentication can permit unauthorized dynamic updates

    OrtaCVSS 5,9Kavram kanıtıEPSS %18

    isc · bind16 Oca 2019

  • CVE-2017-3144
    52Planlayın

    Failure to properly clean up closed OMAPI connections can exhaust available sockets

    YüksekCVSS 7,5İstismar yokEPSS %72

    isc · dhcp16 Oca 2019

  • CVE-2017-3145
    38İzleyin

    Improper fetch cleanup sequencing in the resolver can cause named to crash

    YüksekCVSS 7,5İstismar yokEPSS %27

    isc · bind16 Oca 2019

  • CVE-2018-5733
    36İzleyin

    A malicious client can overflow a reference counter in ISC dhcpd

    YüksekCVSS 7,5İstismar yokEPSS %20

    isc · dhcp16 Oca 2019

  • CVE-2018-5736
    26İzleyin

    An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attem

    OrtaCVSS 5,3İstismar yokEPSS %18

    isc · bind16 Oca 2019

  • CVE-2018-5737
    33İzleyin

    BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.

    YüksekCVSS 7,5İstismar yokEPSS %10

    isc · bind16 Oca 2019

  • CVE-2018-5738
    33İzleyin

    Some versions of BIND can improperly permit recursive query service to unauthorized clients

    YüksekCVSS 7,5İstismar yokEPSS %11

    isc · bind16 Oca 2019

  • CVE-2018-5740
    48Planlayın

    A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    isc · bind16 Oca 2019

  • CVE-2018-20735
    33İzleyin

    An issue was discovered in BMC PATROL Agent through 11.3.01.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %7

    bmc · patrol agent17 Oca 2019

  • CVE-2018-16042
    51Planlayın

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear

    OrtaCVSS 6,5İstismar yokEPSS %82

    adobe · acrobat dc18 Oca 2019

  • CVE-2018-15982
    88Hemen

    Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %89

    adobe · flash player18 Oca 2019

  • CVE-2019-1003000
    65Bu hafta

    A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandb

    YüksekCVSS 8,8SilahlaştırılmışEPSS %98

    jenkins · script security22 Oca 2019

  • CVE-2019-1003001
    61Bu hafta

    A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlo

    YüksekCVSS 8,8SilahlaştırılmışEPSS %86

    jenkins · pipeline\22 Oca 2019

  • CVE-2019-1003002
    59Planlayın

    A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jen

    YüksekCVSS 8,8SilahlaştırılmışEPSS %81

    jenkins · pipeline\22 Oca 2019

  • CVE-2019-6339
    50Planlayın

    PHAR stream wrapper Arbitrary PHP code execution

    KritikCVSS 9,8Kavram kanıtıEPSS %35

    drupal · drupal22 Oca 2019

  • CVE-2018-13374
    58Planlayın

    A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obt

    OrtaCVSS 4,3KEVSilahlaştırılmışEPSS %38

    fortinet · fortiadc22 Oca 2019

  • CVE-2019-6706
    35İzleyin

    Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c.

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    lua · lua23 Oca 2019

  • CVE-2019-1636
    45Planlayın

    Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %46

    cisco · webex teams23 Oca 2019

  • CVE-2018-17686
    33İzleyin

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.2.0.9297.

    OrtaCVSS 6,5İstismar yokEPSS %24

    foxitsoftware · phantompdf24 Oca 2019

  • CVE-2019-1652
    87Hemen

    Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %95

    cisco · rv320 firmware24 Oca 2019

  • CVE-2019-1653
    90Hemen

    Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    cisco · rv320 firmware24 Oca 2019

  • CVE-2019-6799
    27İzleyin

    An issue was discovered in phpMyAdmin before 4.8.5.

    OrtaCVSS 5,9Kavram kanıtıEPSS %14

    phpmyadmin · phpmyadmin26 Oca 2019

  • CVE-2019-6703
    47Planlayın

    Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauth

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    calmar-webmedia · total donations26 Oca 2019

  • CVE-2019-6977
    56Planlayın

    gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.

    YüksekCVSS 8,8Kavram kanıtıEPSS %71

    libgd · libgd26 Oca 2019

  • CVE-2019-3462
    36İzleyin

    Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a

    YüksekCVSS 8,1Kavram kanıtıEPSS %14

    debian · advanced package tool28 Oca 2019

  • CVE-2018-17431
    64Bu hafta

    Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.

    KritikCVSS 9,8Kavram kanıtıEPSS %83

    comodo · unified threat management firewall30 Oca 2019

  • CVE-2018-17189
    27İzleyin

    In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that re

    OrtaCVSS 5,3İstismar yokEPSS %20

    apache · http server30 Oca 2019

  • CVE-2018-17199
    36İzleyin

    In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session.

    YüksekCVSS 7,5İstismar yokEPSS %20

    apache · http server30 Oca 2019

  • CVE-2018-3956
    42Planlayın

    An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader vers

    YüksekCVSS 7,1İstismar yokEPSS %46

    foxitsoftware · phantompdf30 Oca 2019

  • CVE-2019-0190
    48Planlayın

    A bug exists in the way mod_ssl handled client renegotiations.

    YüksekCVSS 7,5İstismar yokEPSS %59

    apache · http server30 Oca 2019

  • CVE-2018-15517
    47Planlayın

    The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but act

    YüksekCVSS 8,6Kavram kanıtıEPSS %44

    dlink · central wifimanager31 Oca 2019

  • CVE-2018-19040
    25İzleyin

    The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocat

    OrtaCVSS 5,3Kavram kanıtıEPSS %12

    media file manager project · media file manager31 Oca 2019

  • CVE-2018-19042
    24İzleyin

    The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to pa

    OrtaCVSS 5,3Kavram kanıtıEPSS %10

    media file manager project · media file manager31 Oca 2019

  • CVE-2018-19043
    24İzleyin

    The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory

    OrtaCVSS 5,3Kavram kanıtıEPSS %10

    media file manager project · media file manager31 Oca 2019

  • CVE-2019-7297
    43Planlayın

    An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03.

    KritikCVSS 9,8İstismar yokEPSS %12

    d-link · dir-823g firmware31 Oca 2019

  • CVE-2019-6110
    34İzleyin

    In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker)

    OrtaCVSS 6,8Kavram kanıtıEPSS %24

    openbsd · openssh31 Oca 2019

  • CVE-2019-6111
    40Planlayın

    An issue was discovered in OpenSSH 7.9.

    OrtaCVSS 5,9Kavram kanıtıEPSS %58

    openbsd · openssh31 Oca 2019