İçeriğe atla
Noroxi

Yayın tarihine göre

Şubat 2019: sömürülen ve yeni ciddi CVE kayıtları

44 kayıt · 6 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2019-7298
    35İzleyin

    An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03.

    YüksekCVSS 8,1İstismar yokEPSS %10

    dlink · dir-823g firmware1 Şub 2019

  • CVE-2017-18362
    95Hemen

    ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %86

    connectwise · manageditsync5 Şub 2019

  • CVE-2018-20753
    78Bu hafta

    Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShel

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %29

    kaseya · virtual system administrator5 Şub 2019

  • CVE-2016-1000282
    60Bu hafta

    Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files.

    KritikCVSS 9,8SilahlaştırılmışEPSS %13

    haraka project · haraka5 Şub 2019

  • CVE-2018-11803
    48Planlayın

    Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if

    YüksekCVSS 7,5İstismar yokEPSS %58

    apache · subversion5 Şub 2019

  • CVE-2018-18990
    33İzleyin

    LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation.

    OrtaCVSS 5,3İstismar yokEPSS %39

    lcds · laquis scada5 Şub 2019

  • CVE-2018-20250
    90Hemen

    In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %96

    rarlab · winrar5 Şub 2019

  • CVE-2018-20251
    31İzleyin

    In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format.

    OrtaCVSS 5,5İstismar yokEPSS %31

    rarlab · winrar5 Şub 2019

  • CVE-2018-18500
    43Planlayın

    A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements.

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    mozilla · firefox5 Şub 2019

  • CVE-2018-3991
    49Planlayın

    An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500.

    KritikCVSS 9,8İstismar yokEPSS %34

    wibu · wibukey5 Şub 2019

  • CVE-2019-1003005
    41Planlayın

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri

    YüksekCVSS 8,8SilahlaştırılmışEPSS %19

    jenkins · script security6 Şub 2019

  • CVE-2019-3822
    43Planlayın

    libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.

    KritikCVSS 9,8İstismar yokEPSS %12

    haxx · libcurl6 Şub 2019

  • CVE-2019-5736
    64Bu hafta

    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequen

    YüksekCVSS 8,6SilahlaştırılmışEPSS %98

    docker · docker11 Şub 2019

  • CVE-2018-20781
    40Planlayın

    In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daem

    YüksekCVSS 7,8SilahlaştırılmışEPSS %1

    gnome · gnome keyring12 Şub 2019

  • CVE-2017-0938
    36İzleyin

    Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplificati

    YüksekCVSS 7,5İstismar yokEPSS %20

    ui · airos12 Şub 2019

  • CVE-2019-6543
    44Planlayın

    AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    aveva · indusoft web studio12 Şub 2019

  • CVE-2019-6545
    34İzleyin

    AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    aveva · indusoft web studio12 Şub 2019

  • CVE-2019-8341
    52Planlayın

    An issue was discovered in Jinja2 2.10.

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    pocoo · jinja215 Şub 2019

  • CVE-2019-6974
    37İzleyin

    In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition,

    YüksekCVSS 8,1Kavram kanıtıEPSS %16

    linux · linux kernel15 Şub 2019

  • CVE-2019-8394
    75Bu hafta

    Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customizat

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %63

    zohocorp · manageengine servicedesk plus17 Şub 2019

  • CVE-2018-20782
    33İzleyin

    The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    globee · woocommerce17 Şub 2019

  • CVE-2019-6453
    48Planlayın

    mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers.

    YüksekCVSS 8,1Kavram kanıtıEPSS %54

    mirc · mirc18 Şub 2019

  • CVE-2019-8903
    60Bu hafta

    index.js in Total.js Platform before 3.2.3 allows path traversal.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %72

    totaljs · total.js18 Şub 2019

  • CVE-2019-8917
    50Planlayın

    SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service.

    KritikCVSS 9,8İstismar yokEPSS %36

    solarwinds · orion network performance monitor18 Şub 2019

  • CVE-2019-5782
    39İzleyin

    Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    google · chrome19 Şub 2019

  • CVE-2019-8942
    60Bu hafta

    WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a

    YüksekCVSS 8,8SilahlaştırılmışEPSS %82

    wordpress · wordpress19 Şub 2019

  • CVE-2019-8943
    54Planlayın

    WordPress through 5.0.3 allows Path Traversal in wp_crop_image().

    OrtaCVSS 6,5SilahlaştırılmışEPSS %91

    wordpress · wordpress19 Şub 2019

  • CVE-2019-8331
    29İzleyin

    In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

    OrtaCVSS 6,1Kavram kanıtıEPSS %16

    getbootstrap · bootstrap20 Şub 2019

  • CVE-2019-8953
    40Planlayın

    The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_lis

    OrtaCVSS 6,1Kavram kanıtıEPSS %52

    netgate · haproxy20 Şub 2019

  • CVE-2019-3924
    35İzleyin

    MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability.

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    mikrotik · routeros20 Şub 2019

  • CVE-2019-8982
    46Planlayın

    com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leadin

    KritikCVSS 9,6Kavram kanıtıEPSS %27

    wavemaker · wavemarker studio21 Şub 2019

  • CVE-2019-8985
    43Planlayın

    On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overf

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    netis-systems · wf2411 firmware21 Şub 2019

  • CVE-2019-6340
    90Hemen

    Drupal core - Highly critical - Remote Code Execution

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %92

    drupal · drupal21 Şub 2019

  • CVE-2019-9020
    42Planlayın

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.

    KritikCVSS 9,8İstismar yokEPSS %10

    php · php22 Şub 2019

  • CVE-2019-9021
    42Planlayın

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.

    KritikCVSS 9,8İstismar yokEPSS %10

    php · php22 Şub 2019

  • CVE-2019-9041
    37İzleyin

    An issue was discovered in ZZZCMS zzzphp V1.6.1.

    YüksekCVSS 7,2Kavram kanıtıEPSS %31

    zzzcms · zzzphp23 Şub 2019

  • CVE-2019-8375
    44Planlayın

    The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent t

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    webkitgtk · webkitgtk24 Şub 2019

  • CVE-2019-9082
    94Hemen

    ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %97

    thinkphp · thinkphp24 Şub 2019

  • CVE-2019-9122
    42Planlayın

    An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices.

    YüksekCVSS 8,8İstismar yokEPSS %23

    dlink · dir-825 rev.b firmware25 Şub 2019

  • CVE-2018-20033
    40Planlayın

    A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a

    KritikCVSS 9,8İstismar yokEPSS %3

    flexera · flexnet publisher25 Şub 2019

  • CVE-2019-9194
    68Bu hafta

    elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

    KritikCVSS 9,8SilahlaştırılmışEPSS %96

    std42 · elfinder26 Şub 2019

  • CVE-2019-4061
    60Bu hafta

    IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets dep

    OrtaCVSS 5,3SilahlaştırılmışEPSS %22

    ibm · bigfix platform27 Şub 2019

  • CVE-2019-1559
    28İzleyin

    0-byte record padding oracle

    OrtaCVSS 5,9İstismar yokEPSS %17

    openssl · openssl27 Şub 2019

  • CVE-2019-1663
    68Bu hafta

    Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %95

    cisco · rv110w firmware28 Şub 2019