İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2019: sömürülen ve yeni ciddi CVE kayıtları

83 kayıt · 20 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2019-19492
    60Bu hafta

    FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.

    KritikCVSS 9,8SilahlaştırılmışEPSS %29

    freeswitch · freeswitch1 Ara 2019

  • CVE-2019-12518
    60Bu hafta

    Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.

    KritikCVSS 9,8SilahlaştırılmışEPSS %50

    anviz · crosschex2 Ara 2019

  • CVE-2019-5096
    59Planlayın

    An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server app

    KritikCVSS 9,8Kavram kanıtıEPSS %66

    embedthis · goahead3 Ara 2019

  • CVE-2019-5097
    44Planlayın

    A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in ve

    YüksekCVSS 7,5İstismar yokEPSS %45

    embedthis · goahead3 Ara 2019

  • CVE-2019-17554
    26İzleyin

    The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entit

    OrtaCVSS 5,5Kavram kanıtıEPSS %12

    apache · olingo4 Ara 2019

  • CVE-2019-19576
    47Planlayın

    class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, om

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    verot project · verot4 Ara 2019

  • CVE-2019-19228
    40Planlayın

    Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account

    KritikCVSS 9,8İstismar yokEPSS %1

    fronius · datamanager box 2.0 firmware4 Ara 2019

  • CVE-2019-19597
    41Planlayın

    D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters w

    YüksekCVSS 8,8İstismar yokEPSS %20

    dlink · dap-1860 firmware5 Ara 2019

  • CVE-2019-7192
    95Hemen

    This improper access control vulnerability allows remote attackers to gain unauthorized access to the system.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %88

    qnap · photo station5 Ara 2019

  • CVE-2019-7193
    73Bu hafta

    This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %14

    qnap · qts5 Ara 2019

  • CVE-2019-7194
    94Hemen

    This external control of file name or path vulnerability allows remote attackers to access or modify system files.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %82

    qnap · photo station5 Ara 2019

  • CVE-2019-7195
    96Hemen

    This external control of file name or path vulnerability allows remote attackers to access or modify system files.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %89

    qnap · photo station5 Ara 2019

  • CVE-2019-19609
    44Planlayın

    The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Adm

    YüksekCVSS 7,2Kavram kanıtıEPSS %54

    strapi · strapi5 Ara 2019

  • CVE-2012-1592
    44Planlayın

    A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and exec

    YüksekCVSS 8,8Kavram kanıtıEPSS %28

    apache · struts5 Ara 2019

  • CVE-2019-5544
    98Hemen

    OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    openslp · openslp6 Ara 2019

  • CVE-2018-7282
    42Planlayın

    The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    titool · printmonitor6 Ara 2019

  • CVE-2019-1551
    25İzleyin

    rsaz_512_sqr overflow bug on x86_64

    OrtaCVSS 5,3İstismar yokEPSS %14

    openssl · openssl6 Ara 2019

  • CVE-2019-19642
    41Planlayın

    On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenti

    YüksekCVSS 8,8İstismar yokEPSS %19

    supermicro · x8sti-f bios8 Ara 2019

  • CVE-2019-19603
    33İzleyin

    SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

    YüksekCVSS 7,5İstismar yokEPSS %10

    sqlite · sqlite9 Ara 2019

  • CVE-2019-17270
    57Planlayın

    Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/system

    KritikCVSS 9,8Kavram kanıtıEPSS %58

    yachtcontrol · yachtcontrol10 Ara 2019

  • CVE-2019-1332
    27İzleyin

    A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    microsoft · power bi report server10 Ara 2019

  • CVE-2019-1458
    83Hemen

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %74

    microsoft · windows 10 150710 Ara 2019

  • CVE-2019-1462
    36İzleyin

    A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory,

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · office10 Ara 2019

  • CVE-2019-1468
    40Planlayın

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k

    YüksekCVSS 8,8İstismar yokEPSS %17

    microsoft · windows 1010 Ara 2019

  • CVE-2019-1481
    22İzleyin

    An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Medi

    OrtaCVSS 4,3İstismar yokEPSS %16

    microsoft · windows 710 Ara 2019

  • CVE-2019-19719
    31İzleyin

    Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.

    OrtaCVSS 6,1İstismar yokEPSS %22

    tableau · tableau server11 Ara 2019

  • CVE-2019-18935
    99Hemen

    Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    telerik · ui for asp.net ajax11 Ara 2019

  • CVE-2013-5743
    63Bu hafta

    Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.

    KritikCVSS 9,8SilahlaştırılmışEPSS %79

    zabbix · zabbix11 Ara 2019

  • CVE-2019-19726
    40Planlayın

    OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting

    YüksekCVSS 7,8SilahlaştırılmışEPSS %3

    openbsd · openbsd11 Ara 2019

  • CVE-2017-18640
    38İzleyin

    The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

    YüksekCVSS 7,5İstismar yokEPSS %26

    snakeyaml project · snakeyaml11 Ara 2019

  • CVE-2019-19774
    39İzleyin

    An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110.

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    zohocorp · manageengine eventlog analyzer13 Ara 2019

  • CVE-2019-19368
    32İzleyin

    A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.

    OrtaCVSS 6,1Kavram kanıtıEPSS %25

    maxum · rumpus16 Ara 2019

  • CVE-2019-19731
    33İzleyin

    Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    roxyfileman · roxy fileman16 Ara 2019

  • CVE-2019-3993
    44Planlayın

    ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability.

    YüksekCVSS 7,5İstismar yokEPSS %45

    elog project · elog17 Ara 2019

  • CVE-2019-3995
    39İzleyin

    ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference.

    YüksekCVSS 7,5İstismar yokEPSS %28

    elog project · elog17 Ara 2019

  • CVE-2019-7481
    90Hemen

    Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    sonicwall · sma 100 firmware17 Ara 2019

  • CVE-2019-19742
    25İzleyin

    On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.

    OrtaCVSS 4,8Kavram kanıtıEPSS %19

    dlink · dir-615 firmware18 Ara 2019

  • CVE-2019-11400
    44Planlayın

    An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices.

    KritikCVSS 9,8İstismar yokEPSS %16

    trendnet · tew-651br firmware18 Ara 2019

  • CVE-2019-4716
    95Hemen

    IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %86

    ibm · planning analytics18 Ara 2019

  • CVE-2019-19833
    60Bu hafta

    In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %14

    tautulli · tautulli18 Ara 2019

  • CVE-2019-7286
    66Bu hafta

    A memory corruption issue was addressed with improved input validation.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %15

    apple · iphone os18 Ara 2019

  • CVE-2019-7287
    62Bu hafta

    A memory corruption issue was addressed with improved input validation.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %4

    apple · iphone os18 Ara 2019

  • CVE-2019-8506
    70Bu hafta

    A type confusion issue was addressed with improved memory handling.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %16

    apple · icloud18 Ara 2019

  • CVE-2019-8513
    40Planlayın

    This issue was addressed with improved checks.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %2

    apple · mac os x18 Ara 2019

  • CVE-2019-8518
    38İzleyin

    Multiple memory corruption issues were addressed with improved memory handling.

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    apple · icloud18 Ara 2019

  • CVE-2019-8526
    61Bu hafta

    A use after free issue was addressed with improved memory management.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    apple · mac os x18 Ara 2019

  • CVE-2019-8565
    40Planlayın

    A race condition was addressed with additional validation.

    YüksekCVSS 7,0SilahlaştırılmışEPSS %13

    apple · iphone os18 Ara 2019

  • CVE-2019-8577
    34İzleyin

    An input validation issue was addressed with improved memory handling.

    YüksekCVSS 7,8İstismar yokEPSS %10

    apple · icloud18 Ara 2019

  • CVE-2019-8598
    25İzleyin

    An input validation issue was addressed with improved input validation.

    OrtaCVSS 5,5İstismar yokEPSS %10

    apple · icloud18 Ara 2019

  • CVE-2019-8600
    45Planlayın

    A memory corruption issue was addressed with improved input validation.

    KritikCVSS 9,8İstismar yokEPSS %20

    apple · icloud18 Ara 2019

  • CVE-2019-8602
    34İzleyin

    A memory corruption issue was addressed by removing the vulnerable code.

    YüksekCVSS 7,8İstismar yokEPSS %10

    apple · icloud18 Ara 2019

  • CVE-2019-8605
    66Bu hafta

    A use after free issue was addressed with improved memory management.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %17

    apple · iphone os18 Ara 2019

  • CVE-2019-8613
    43Planlayın

    A use after free issue was addressed with improved memory management.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    apple · iphone os18 Ara 2019

  • CVE-2019-8641
    44Planlayın

    An out-of-bounds read was addressed with improved input validation.

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    apple · iphone os18 Ara 2019

  • CVE-2019-8646
    33İzleyin

    An out-of-bounds read was addressed with improved input validation.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    apple · iphone os18 Ara 2019

  • CVE-2019-8647
    43Planlayın

    A use after free issue was addressed with improved memory management.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    apple · iphone os18 Ara 2019

  • CVE-2019-8660
    43Planlayın

    A memory corruption issue was addressed with improved input validation.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    apple · iphone os18 Ara 2019

  • CVE-2019-8661
    42Planlayın

    A use after free issue was addressed with improved memory management.

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    apple · mac os x18 Ara 2019

  • CVE-2019-8672
    38İzleyin

    Multiple memory corruption issues were addressed with improved memory handling.

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    apple · icloud18 Ara 2019

  • CVE-2019-8689
    39İzleyin

    Multiple memory corruption issues were addressed with improved memory handling.

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    apple · icloud18 Ara 2019

  • CVE-2019-19844
    55Planlayın

    Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.

    KritikCVSS 9,8Kavram kanıtıEPSS %53

    djangoproject · django18 Ara 2019

  • CVE-2019-7483
    61Bu hafta

    In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the prese

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %4

    sonicwall · sma 100 firmware18 Ara 2019

  • CVE-2019-16451
    49Planlayın

    Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    adobe · acrobat dc19 Ara 2019

  • CVE-2019-19908
    30İzleyin

    phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL.

    OrtaCVSS 6,1Kavram kanıtıEPSS %21

    ciprianmp · phpmychat-plus20 Ara 2019

  • CVE-2019-15914
    30İzleyin

    An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices.

    YüksekCVSS 7,5İstismar yokEPSS %1

    mi · dgnwg03lm firmware20 Ara 2019

  • CVE-2019-17571
    60Bu hafta

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe

    KritikCVSS 9,8Kavram kanıtıEPSS %69

    apache · log4j20 Ara 2019

  • CVE-2019-5108
    29İzleyin

    An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3.

    OrtaCVSS 6,5İstismar yokEPSS %10

    linux · linux kernel23 Ara 2019

  • CVE-2019-17563
    33İzleyin

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an

    YüksekCVSS 7,5İstismar yokEPSS %10

    apache · tomcat23 Ara 2019

  • CVE-2019-19924
    24İzleyin

    SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c.

    OrtaCVSS 5,3İstismar yokEPSS %10

    sqlite · sqlite24 Ara 2019

  • CVE-2019-10758
    94Hemen

    mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.

    KritikCVSS 9,9KEVSilahlaştırılmışEPSS %84

    mongo-express project · mongo-express24 Ara 2019

  • CVE-2019-19985
    42Planlayın

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user informat

    OrtaCVSS 5,3Kavram kanıtıEPSS %71

    icegram · email subscribers \& newsletters25 Ara 2019

  • CVE-2019-19781
    99Hemen

    An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    citrix · application delivery controller firmware27 Ara 2019

  • CVE-2013-4975
    39İzleyin

    Hikvision DS-2CD7153-E IP Camera has Privilege Escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    hikvision · ds-2cd7153-e firmware27 Ara 2019

  • CVE-2013-4976
    50Planlayın

    Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials

    KritikCVSS 9,8Kavram kanıtıEPSS %36

    hikvision · ds-2cd7153-e firmware27 Ara 2019

  • CVE-2013-4982
    43Planlayın

    AVTECH AVN801 DVR has a security bypass via the administration login captcha

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    avtech · avn801 dvr firmware27 Ara 2019

  • CVE-2019-20049
    43Planlayın

    An issue was discovered on Alcatel-Lucent OmniVista 4760 devices.

    KritikCVSS 9,8İstismar yokEPSS %12

    al-enterprise · omnivista 476027 Ara 2019

  • CVE-2014-5289
    43Planlayın

    Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request.

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    senkas kolibri project · senkas kolibri27 Ara 2019

  • CVE-2019-20085
    89Hemen

    TVT NVMS-1000 devices allow GET /..

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %96

    tvt · nvms-1000 firmware29 Ara 2019

  • CVE-2019-20139
    29İzleyin

    In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or freque

    OrtaCVSS 5,4İstismar yokEPSS %26

    nagios · nagios xi30 Ara 2019

  • CVE-2019-17558
    90Hemen

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %98

    apache · solr30 Ara 2019

  • CVE-2019-17621
    96Hemen

    The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %89

    dlink · dir-859 firmware30 Ara 2019

  • CVE-2019-7751
    34İzleyin

    A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing,

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    ricoh · fusionpro vdp31 Ara 2019

  • CVE-2019-20197
    42Planlayın

    In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to scheduler

    YüksekCVSS 8,8Kavram kanıtıEPSS %22

    nagios · nagios xi31 Ara 2019