İçeriğe atla
Noroxi

Yayın tarihine göre

Ağustos 2019: sömürülen ve yeni ciddi CVE kayıtları

86 kayıt · 6 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2019-0193
    83Hemen

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %83

    apache · solr1 Ağu 2019

  • CVE-2019-14529
    47Planlayın

    OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.

    KritikCVSS 9,8Kavram kanıtıEPSS %28

    open-emr · openemr2 Ağu 2019

  • CVE-2019-14348
    45Planlayın

    The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seaso

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    beardev · joomsport5 Ağu 2019

  • CVE-2019-14696
    29İzleyin

    Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.

    OrtaCVSS 6,1Kavram kanıtıEPSS %15

    open-school · open-school6 Ağu 2019

  • CVE-2019-1912
    41Planlayın

    Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability

    KritikCVSS 9,1Kavram kanıtıEPSS %17

    cisco · sf-220-24 firmware7 Ağu 2019

  • CVE-2019-1913
    47Planlayın

    Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    cisco · sf-220-24 firmware7 Ağu 2019

  • CVE-2019-1914
    35İzleyin

    Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability

    YüksekCVSS 7,2Kavram kanıtıEPSS %24

    cisco · sf-220-24 firmware7 Ağu 2019

  • CVE-2019-14750
    27İzleyin

    An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    enhancesoft · osticket7 Ağu 2019

  • CVE-2019-13101
    59Planlayın

    An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices.

    KritikCVSS 9,8Kavram kanıtıEPSS %67

    dlink · dir-600m firmware8 Ağu 2019

  • CVE-2019-14234
    53Planlayın

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.

    KritikCVSS 9,8Kavram kanıtıEPSS %47

    djangoproject · django9 Ağu 2019

  • CVE-2019-14312
    32İzleyin

    Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer.

    OrtaCVSS 6,5Kavram kanıtıEPSS %20

    aptana · jaxer9 Ağu 2019

  • CVE-2019-12256
    47Planlayın

    Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component.

    KritikCVSS 9,8İstismar yokEPSS %26

    windriver · vxworks9 Ağu 2019

  • CVE-2019-12257
    60Bu hafta

    Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.

    YüksekCVSS 8,8İstismar yokEPSS %84

    windriver · vxworks9 Ağu 2019

  • CVE-2019-12259
    35İzleyin

    Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component.

    YüksekCVSS 7,5İstismar yokEPSS %15

    windriver · vxworks9 Ağu 2019

  • CVE-2019-12265
    39İzleyin

    Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component.

    OrtaCVSS 5,3İstismar yokEPSS %59

    windriver · vxworks9 Ağu 2019

  • CVE-2019-11581
    94Hemen

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail a

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %84

    atlassian · jira server9 Ağu 2019

  • CVE-2019-12255
    62Bu hafta

    Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4).

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    windriver · vxworks9 Ağu 2019

  • CVE-2019-12258
    37İzleyin

    Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %22

    windriver · vxworks9 Ağu 2019

  • CVE-2019-12260
    46Planlayın

    Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4).

    KritikCVSS 9,8İstismar yokEPSS %23

    windriver · vxworks9 Ağu 2019

  • CVE-2019-13462
    39İzleyin

    Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

    KritikCVSS 9,1Kavram kanıtıEPSS %11

    lansweeper · lansweeper12 Ağu 2019

  • CVE-2019-14530
    55Planlayın

    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter.

    YüksekCVSS 8,8Kavram kanıtıEPSS %65

    open-emr · openemr13 Ağu 2019

  • CVE-2019-9511
    48Planlayın

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    apple · swiftnio13 Ağu 2019

  • CVE-2019-9512
    55Planlayın

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

    YüksekCVSS 7,5İstismar yokEPSS %83

    apple · swiftnio13 Ağu 2019

  • CVE-2019-9513
    54Planlayın

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

    YüksekCVSS 7,5İstismar yokEPSS %81

    apple · swiftnio13 Ağu 2019

  • CVE-2019-9514
    55Planlayın

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    YüksekCVSS 7,5İstismar yokEPSS %82

    apple · swiftnio13 Ağu 2019

  • CVE-2019-9515
    56Planlayın

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

    YüksekCVSS 7,5İstismar yokEPSS %87

    apple · swiftnio13 Ağu 2019

  • CVE-2019-9516
    43Planlayın

    Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

    OrtaCVSS 6,5İstismar yokEPSS %56

    apple · swiftnio13 Ağu 2019

  • CVE-2019-9517
    38İzleyin

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

    YüksekCVSS 7,5İstismar yokEPSS %27

    apple · swiftnio13 Ağu 2019

  • CVE-2019-9518
    38İzleyin

    Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

    YüksekCVSS 7,5İstismar yokEPSS %25

    apple · swiftnio13 Ağu 2019

  • CVE-2019-0344
    71Bu hafta

    Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possi

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %7

    sap · commerce cloud14 Ağu 2019

  • CVE-2019-14974
    33İzleyin

    SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.

    OrtaCVSS 6,1Kavram kanıtıEPSS %28

    sugarcrm · sugarcrm14 Ağu 2019

  • CVE-2019-1144
    39İzleyin

    Microsoft Graphics Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1145
    39İzleyin

    Microsoft Graphics Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1149
    39İzleyin

    Microsoft Graphics Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    microsoft · office14 Ağu 2019

  • CVE-2019-1150
    43Planlayın

    Microsoft Graphics Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %26

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1151
    40Planlayın

    Microsoft Graphics Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %15

    microsoft · office14 Ağu 2019

  • CVE-2019-1152
    39İzleyin

    Microsoft Graphics Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1159
    34İzleyin

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %11

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1181
    62Bu hafta

    Remote Desktop Services Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %75

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1182
    44Planlayın

    Remote Desktop Services Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %16

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1184
    47Planlayın

    Windows Elevation of Privilege Vulnerability

    OrtaCVSS 6,7Kavram kanıtıEPSS %70

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-1225
    33İzleyin

    Remote Desktop Protocol Server Information Disclosure Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · windows 1014 Ağu 2019

  • CVE-2019-12854
    34İzleyin

    Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory.

    YüksekCVSS 7,5İstismar yokEPSS %11

    squid-cache · squid15 Ağu 2019

  • CVE-2019-14422
    40Planlayın

    An issue was discovered in in TortoiseSVN 1.12.1.

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    tortoisesvn · tortoisesvn15 Ağu 2019

  • CVE-2019-13510
    35İzleyin

    Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416.

    YüksekCVSS 7,8İstismar yokEPSS %12

    rockwellautomation · arena15 Ağu 2019

  • CVE-2019-10081
    34İzleyin

    HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the

    YüksekCVSS 7,5İstismar yokEPSS %14

    apache · http server15 Ağu 2019

  • CVE-2019-9851
    62Bu hafta

    LibreLogo global-event script execution

    KritikCVSS 9,8SilahlaştırılmışEPSS %77

    libreoffice · libreoffice15 Ağu 2019

  • CVE-2019-15106
    47Planlayın

    An issue was discovered in Zoho ManageEngine OpManager in builds before 14310.

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    zohocorp · manageengine opmanager15 Ağu 2019

  • CVE-2019-15107
    99Hemen

    An issue was discovered in Webmin <=1.920.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    webmin · webmin15 Ağu 2019

  • CVE-2019-7964
    42Planlayın

    Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability.

    KritikCVSS 9,8İstismar yokEPSS %10

    adobe · experience manager16 Ağu 2019

  • CVE-2015-9323
    53Planlayın

    The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %46

    duckdev · 404 to 30116 Ağu 2019

  • CVE-2019-3963
    40Planlayın

    In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.

    OrtaCVSS 6,1İstismar yokEPSS %52

    open-emr · openemr20 Ağu 2019

  • CVE-2019-3964
    40Planlayın

    In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.

    OrtaCVSS 6,1İstismar yokEPSS %52

    open-emr · openemr20 Ağu 2019

  • CVE-2019-3967
    35İzleyin

    In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to

    OrtaCVSS 6,5İstismar yokEPSS %29

    open-emr · openemr20 Ağu 2019

  • CVE-2019-8016
    46Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %22

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8017
    43Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8024
    44Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8041
    44Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8042
    44Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8043
    34İzleyin

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8044
    43Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8045
    44Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8046
    44Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8048
    49Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8049
    45Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-8050
    51Planlayın

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    KritikCVSS 9,8Kavram kanıtıEPSS %40

    adobe · acrobat dc20 Ağu 2019

  • CVE-2019-10086
    38İzleyin

    In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access

    YüksekCVSS 7,3İstismar yokEPSS %28

    apache · commons beanutils20 Ağu 2019

  • CVE-2019-12624
    40Planlayın

    Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %18

    cisco · ios xe21 Ağu 2019

  • CVE-2019-1935
    64Bu hafta

    Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %83

    cisco · integrated management controller supervisor21 Ağu 2019

  • CVE-2019-1936
    40Planlayın

    Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection Vulnerability

    YüksekCVSS 7,2SilahlaştırılmışEPSS %39

    cisco · integrated management controller supervisor21 Ağu 2019

  • CVE-2019-1937
    62Bu hafta

    Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %75

    cisco · integrated management controller supervisor21 Ağu 2019

  • CVE-2016-10924
    33İzleyin

    The ebook-download plugin before 1.2 for WordPress has directory traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    zedna ebook download project · zedna ebook download22 Ağu 2019

  • CVE-2017-18580
    43Planlayın

    The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    getshortcodes · shortcodes ultimate22 Ağu 2019

  • CVE-2019-11013
    34İzleyin

    Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability.

    OrtaCVSS 6,5Kavram kanıtıEPSS %26

    softvelum · nimble streamer22 Ağu 2019

  • CVE-2019-8446
    26İzleyin

    The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect author

    OrtaCVSS 5,3Kavram kanıtıEPSS %17

    atlassian · jira server23 Ağu 2019

  • CVE-2019-15637
    36İzleyin

    Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a

    YüksekCVSS 8,1Kavram kanıtıEPSS %14

    tableau · tableau server26 Ağu 2019

  • CVE-2019-15642
    45Planlayın

    rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an e

    YüksekCVSS 8,8Kavram kanıtıEPSS %34

    webmin · webmin26 Ağu 2019

  • CVE-2019-7989
    39İzleyin

    Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability.

    YüksekCVSS 8,8İstismar yokEPSS %14

    adobe · photoshop cc26 Ağu 2019

  • CVE-2019-14314
    52Planlayın

    A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    imagely · nextgen gallery27 Ağu 2019

  • CVE-2019-15752
    76Bu hafta

    Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.ex

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %48

    docker · docker28 Ağu 2019

  • CVE-2019-11248
    55Planlayın

    Kubernetes kubelet exposes /debug/pprof info on healthz port

    YüksekCVSS 8,2Kavram kanıtıEPSS %75

    kubernetes · kubernetes28 Ağu 2019

  • CVE-2019-11500
    58Planlayın

    In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings.

    KritikCVSS 9,8İstismar yokEPSS %62

    dovecot · dovecot29 Ağu 2019

  • CVE-2019-3394
    38İzleyin

    There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting.

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    atlassian · confluence29 Ağu 2019

  • CVE-2019-13608
    69Bu hafta

    Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %30

    citrix · storefront server29 Ağu 2019

  • CVE-2019-12402
    35İzleyin

    The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speci

    YüksekCVSS 7,5İstismar yokEPSS %16

    apache · commons compress30 Ağu 2019

  • CVE-2019-15821
    33İzleyin

    The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.

    YüksekCVSS 7,5İstismar yokEPSS %11

    bold-themes · bold page builder30 Ağu 2019