İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2019: sömürülen ve yeni ciddi CVE kayıtları

61 kayıt · 9 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2011-3923
    66Bu hafta

    Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary

    KritikCVSS 9,8SilahlaştırılmışEPSS %89

    apache · struts1 Kas 2019

  • CVE-2013-2227
    34İzleyin

    GLPI 0.83.7 has Local File Inclusion in common.tabs.php.

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    glpi-project · glpi1 Kas 2019

  • CVE-2019-18665
    34İzleyin

    The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion.

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    secudos · domos2 Kas 2019

  • CVE-2013-2261
    33İzleyin

    Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    cryptocat project · cryptocat4 Kas 2019

  • CVE-2014-9013
    49Planlayın

    The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to c

    YüksekCVSS 8,8Kavram kanıtıEPSS %46

    wpmarketplace project · wpmarketplace6 Kas 2019

  • CVE-2014-9014
    20İzleyin

    Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for Word

    OrtaCVSS 4,3Kavram kanıtıEPSS %11

    wpmarketplace project · wpmarketplace6 Kas 2019

  • CVE-2019-12419
    43Planlayın

    Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service.

    KritikCVSS 9,8İstismar yokEPSS %13

    apache · cxf6 Kas 2019

  • CVE-2019-18818
    68Bu hafta

    strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-p

    KritikCVSS 9,8SilahlaştırılmışEPSS %97

    strapi · strapi7 Kas 2019

  • CVE-2019-18655
    43Planlayın

    File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    upredsun · file sharing wizard12 Kas 2019

  • CVE-2019-0719
    39İzleyin

    A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an a

    KritikCVSS 9,1İstismar yokEPSS %11

    microsoft · windows 1012 Kas 2019

  • CVE-2019-0721
    40Planlayın

    A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an a

    KritikCVSS 9,1İstismar yokEPSS %12

    microsoft · windows 1012 Kas 2019

  • CVE-2019-1234
    53Planlayın

    A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.

    YüksekCVSS 7,5İstismar yokEPSS %75

    microsoft · azure stack12 Kas 2019

  • CVE-2019-1373
    46Planlayın

    A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Ex

    KritikCVSS 9,8İstismar yokEPSS %21

    microsoft · exchange server12 Kas 2019

  • CVE-2019-1385
    62Bu hafta

    An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulti

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    microsoft · windows 10 170912 Kas 2019

  • CVE-2019-1388
    64Bu hafta

    An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Win

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %8

    microsoft · windows 10 150712 Kas 2019

  • CVE-2019-1405
    70Bu hafta

    An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %30

    microsoft · windows 10 150712 Kas 2019

  • CVE-2019-1406
    35İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · windows 1012 Kas 2019

  • CVE-2019-1419
    38İzleyin

    A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially c

    YüksekCVSS 8,8İstismar yokEPSS %11

    microsoft · windows 1012 Kas 2019

  • CVE-2019-1429
    83Hemen

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %77

    microsoft · internet explorer12 Kas 2019

  • CVE-2019-1430
    35İzleyin

    A remote code execution vulnerability exists when Windows Media Foundation improperly parses specially crafted QuickTime media files.An atta

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · windows 1012 Kas 2019

  • CVE-2019-1439
    49Planlayın

    An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows

    OrtaCVSS 6,5İstismar yokEPSS %75

    microsoft · windows 1012 Kas 2019

  • CVE-2019-1441
    39İzleyin

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k

    YüksekCVSS 8,8İstismar yokEPSS %12

    microsoft · windows 712 Kas 2019

  • CVE-2019-1448
    40Planlayın

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    YüksekCVSS 7,8İstismar yokEPSS %29

    microsoft · excel12 Kas 2019

  • CVE-2019-18240
    43Planlayın

    In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely

    KritikCVSS 9,8İstismar yokEPSS %14

    fujielectric · v-server13 Kas 2019

  • CVE-2019-18951
    36İzleyin

    SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files.

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    sibsoft · xfilesharing13 Kas 2019

  • CVE-2019-18952
    53Planlayın

    SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload.

    KritikCVSS 9,8Kavram kanıtıEPSS %45

    sibsoft · xfilesharing13 Kas 2019

  • CVE-2019-5029
    56Planlayın

    An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1.

    KritikCVSS 9,8Kavram kanıtıEPSS %57

    exhibitor project · exhibitor13 Kas 2019

  • CVE-2011-1930
    45Planlayın

    In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped.

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    klibc project · klibc13 Kas 2019

  • CVE-2019-18937
    49Planlayın

    eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticat

    KritikCVSS 9,8İstismar yokEPSS %33

    eq-3 · homematic ccu214 Kas 2019

  • CVE-2019-18938
    49Planlayın

    eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated

    KritikCVSS 9,8İstismar yokEPSS %33

    eq-3 · homematic ccu214 Kas 2019

  • CVE-2019-18939
    51Planlayın

    eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated a

    KritikCVSS 9,8İstismar yokEPSS %40

    eq-3 · homematic ccu214 Kas 2019

  • CVE-2019-19012
    42Planlayın

    An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    oniguruma project · oniguruma17 Kas 2019

  • CVE-2019-10172
    35İzleyin

    A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries.

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    fasterxml · jackson-mapper-asl18 Kas 2019

  • CVE-2019-12409
    45Planlayın

    The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default s

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    apache · solr18 Kas 2019

  • CVE-2011-2921
    64Bu hafta

    ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can res

    KritikCVSS 9,8SilahlaştırılmışEPSS %83

    ktsuss project · ktsuss19 Kas 2019

  • CVE-2019-16340
    45Planlayın

    Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cg

    KritikCVSS 9,8İstismar yokEPSS %19

    linksys · velop whw0303 firmware21 Kas 2019

  • CVE-2018-8879
    44Planlayın

    Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devi

    KritikCVSS 9,8İstismar yokEPSS %17

    asus · rt-ac66u firmware21 Kas 2019

  • CVE-2019-6693
    58Planlayın

    Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %6

    fortinet · fortios21 Kas 2019

  • CVE-2019-16405
    36İzleyin

    Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an adm

    YüksekCVSS 7,2Kavram kanıtıEPSS %27

    centreon · centreon web21 Kas 2019

  • CVE-2019-16758
    35İzleyin

    In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using /../../.

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    lexmark · services monitor firmware21 Kas 2019

  • CVE-2019-19006
    86Hemen

    Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %55

    sangoma · freepbx21 Kas 2019

  • CVE-2019-19207
    42Planlayın

    rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.

    YüksekCVSS 8,8İstismar yokEPSS %22

    rconfig · rconfig21 Kas 2019

  • CVE-2019-18889
    49Planlayın

    An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.

    KritikCVSS 9,8İstismar yokEPSS %33

    sensiolabs · symfony21 Kas 2019

  • CVE-2019-18976
    34İzleyin

    An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x.

    YüksekCVSS 7,5İstismar yokEPSS %12

    digium · asterisk22 Kas 2019

  • CVE-2019-18610
    50Planlayın

    An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4.

    YüksekCVSS 8,8İstismar yokEPSS %50

    digium · asterisk22 Kas 2019

  • CVE-2019-13720
    80Hemen

    Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a cra

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %49

    google · chrome25 Kas 2019

  • CVE-2019-5825
    73Bu hafta

    Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption vi

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %55

    google · chrome25 Kas 2019

  • CVE-2011-3596
    33İzleyin

    Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    polipo project · polipo25 Kas 2019

  • CVE-2011-3600
    35İzleyin

    The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    apache · ofbiz25 Kas 2019

  • CVE-2019-15271
    67Bu hafta

    Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %5

    cisco · rv016 multi-wan vpn firmware25 Kas 2019

  • CVE-2019-15276
    40Planlayın

    Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %46

    cisco · wireless lan controller software25 Kas 2019

  • CVE-2011-4350
    40Planlayın

    Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %16

    yaws · yaws26 Kas 2019

  • CVE-2015-9538
    40Planlayın

    The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %10

    imagely · nextgen gallery26 Kas 2019

  • CVE-2019-19307
    52Planlayın

    An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possib

    KritikCVSS 9,8İstismar yokEPSS %42

    cesanta · mongoose26 Kas 2019

  • CVE-2019-12526
    45Planlayın

    An issue was discovered in Squid before 4.9.

    KritikCVSS 9,8İstismar yokEPSS %20

    squid-cache · squid26 Kas 2019

  • CVE-2019-18679
    42Planlayın

    An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8.

    YüksekCVSS 7,5İstismar yokEPSS %40

    squid-cache · squid26 Kas 2019

  • CVE-2019-15298
    43Planlayın

    A problem was found in Centreon Web through 19.04.3.

    YüksekCVSS 8,8İstismar yokEPSS %26

    centreon · centreon web27 Kas 2019

  • CVE-2017-12945
    40Planlayın

    Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to

    YüksekCVSS 8,8Kavram kanıtıEPSS %17

    mersive · solstice firmware27 Kas 2019

  • CVE-2011-2523
    68Bu hafta

    vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

    KritikCVSS 9,8SilahlaştırılmışEPSS %96

    vsftpd project · vsftpd27 Kas 2019

  • CVE-2019-14901
    44Planlayın

    A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver.

    KritikCVSS 9,8İstismar yokEPSS %16

    linux · linux kernel29 Kas 2019

  • CVE-2019-18922
    37İzleyin

    A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    alliedtelesis · at-gs950\/8 firmware29 Kas 2019