İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2019: sömürülen ve yeni ciddi CVE kayıtları

122 kayıt · 16 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2019-2649
    41Planlayın

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services).

    YüksekCVSS 7,5İstismar yokEPSS %36

    oracle · weblogic server23 Nis 2019

  • CVE-2019-2650
    42Planlayın

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services).

    YüksekCVSS 7,5İstismar yokEPSS %39

    oracle · weblogic server23 Nis 2019

  • CVE-2019-2684
    34İzleyin

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI).

    OrtaCVSS 5,9İstismar yokEPSS %37

    oracle · jdk23 Nis 2019

  • CVE-2019-2697
    35İzleyin

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D).

    YüksekCVSS 8,1Kavram kanıtıEPSS %11

    oracle · jdk23 Nis 2019

  • CVE-2019-2698
    36İzleyin

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D).

    YüksekCVSS 8,1Kavram kanıtıEPSS %12

    oracle · jdk23 Nis 2019

  • CVE-2019-7213
    38İzleyin

    SmarterTools SmarterMail 16.x before build 6985 allows directory traversal.

    OrtaCVSS 6,5Kavram kanıtıEPSS %41

    smartertools · smartermail24 Nis 2019

  • CVE-2019-7214
    64Bu hafta

    SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.

    KritikCVSS 9,8SilahlaştırılmışEPSS %84

    smartertools · smartermail24 Nis 2019

  • CVE-2019-10008
    41Planlayın

    Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically co

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    zohocorp · servicedesk plus24 Nis 2019

  • CVE-2018-20434
    60Bu hafta

    LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.

    KritikCVSS 9,8SilahlaştırılmışEPSS %71

    librenms · librenms24 Nis 2019

  • CVE-2018-16660
    40Planlayın

    A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated acces

    YüksekCVSS 8,8SilahlaştırılmışEPSS %17

    imperva · securesphere25 Nis 2019

  • CVE-2019-3721
    31İzleyin

    Improper Range Header Processing Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %2

    dell · emc openmanage server administrator25 Nis 2019

  • CVE-2019-11539
    88Hemen

    In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %98

    ivanti · connect secure25 Nis 2019

  • CVE-2019-11542
    48Planlayın

    In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an

    YüksekCVSS 7,2İstismar yokEPSS %65

    ivanti · connect secure25 Nis 2019

  • CVE-2019-0186
    30İzleyin

    The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks.

    OrtaCVSS 6,1Kavram kanıtıEPSS %20

    apache · pluto26 Nis 2019

  • CVE-2019-9791
    45Planlayın

    The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    mozilla · firefox26 Nis 2019

  • CVE-2019-9792
    43Planlayın

    The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    mozilla · firefox26 Nis 2019

  • CVE-2019-9810
    43Planlayın

    Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflo

    YüksekCVSS 8,8Kavram kanıtıEPSS %27

    mozilla · firefox26 Nis 2019

  • CVE-2019-2725
    99Hemen

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    oracle · agile product lifecycle management26 Nis 2019

  • CVE-2019-11577
    55Planlayın

    dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.

    KritikCVSS 9,8İstismar yokEPSS %53

    dhcpcd project · dhcpcd28 Nis 2019

  • CVE-2019-9621
    84Hemen

    Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %81

    synacor · zimbra collaboration suite30 Nis 2019

  • CVE-2019-3929
    99Hemen

    The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    crestron · am-100 firmware30 Nis 2019

  • CVE-2019-3932
    50Planlayın

    Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password

    KritikCVSS 9,8İstismar yokEPSS %36

    crestron · am-100 firmware30 Nis 2019