Yayın tarihine göre
Mayıs 2019: sömürülen ve yeni ciddi CVE kayıtları
110 kayıt · 14 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 2 / 2
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
41Planlayın | CVE-2019-9858Silahlaştırılmış | Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.horde · groupware · CWE-22 | Yüksek8,8 | — | %18,8 | 29 May 2019 |
66Bu hafta | CVE-2018-13383Silahlaştırılmış | A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxfortinet · fortiproxy · CWE-787 | Orta6,5 | KEV | %33,6 | 29 May 2019 |
42Planlayın | CVE-2019-12347Kavram kanıtı | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accounnetgate · pfsense · CWE-79 | Orta6,1 | — | %58,5 | 29 May 2019 |
99Hemen | CVE-2019-9670Silahlaştırılmış | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, assynacor · zimbra collaboration suite · CWE-611 | Kritik9,8 | KEV | %99,9 | 29 May 2019 |
53Planlayın | CVE-2019-8457İstismar yok | SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tsqlite · sqlite · CWE-125 | Kritik9,8 | — | %45,4 | 30 May 2019 |
40Planlayın | CVE-2019-12480Kavram kanıtı | BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in Atbacnet protocol stack project · bacnet protocol stack · CWE-125 | Yüksek7,5 | — | %33,8 | 30 May 2019 |
94Hemen | CVE-2019-9874Silahlaştırılmış | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 tositecore · cms · CWE-502 | Kritik9,8 | KEV | %83,7 | 31 May 2019 |
69Bu hafta | CVE-2019-9875Silahlaştırılmış | Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary codesitecore · cms · CWE-502 | Yüksek8,8 | KEV | %13,7 | 31 May 2019 |
60Bu hafta | CVE-2019-10123Silahlaştırılmış | SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous ais · logistic software · CWE-89 | Kritik9,8 | — | %65,8 | 31 May 2019 |
42Planlayın | CVE-2019-9653Kavram kanıtı | NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacnuuo · network video recorder firmware · CWE-78 | Kritik9,8 | — | %11,4 | 31 May 2019 |
- CVE-2019-985841Planlayın
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.
YüksekCVSS 8,8SilahlaştırılmışEPSS %18horde · groupware29 May 2019
- CVE-2018-1338366Bu hafta
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProx
OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %33fortinet · fortiproxy29 May 2019
- CVE-2019-1234742Planlayın
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accoun
OrtaCVSS 6,1Kavram kanıtıEPSS %58netgate · pfsense29 May 2019
- CVE-2019-967099Hemen
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99synacor · zimbra collaboration suite29 May 2019
- CVE-2019-845753Planlayın
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree t
KritikCVSS 9,8İstismar yokEPSS %45sqlite · sqlite30 May 2019
- CVE-2019-1248040Planlayın
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in At
YüksekCVSS 7,5Kavram kanıtıEPSS %33bacnet protocol stack project · bacnet protocol stack30 May 2019
- CVE-2019-987494Hemen
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %83sitecore · cms31 May 2019
- CVE-2019-987569Bu hafta
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code
YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %13sitecore · cms31 May 2019
- CVE-2019-1012360Bu hafta
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous
KritikCVSS 9,8SilahlaştırılmışEPSS %65ais · logistic software31 May 2019
- CVE-2019-965342Planlayın
NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharac
KritikCVSS 9,8Kavram kanıtıEPSS %11nuuo · network video recorder firmware31 May 2019