İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2020: sömürülen ve yeni ciddi CVE kayıtları

54 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2020-7351
    55Planlayın

    Fonality Trixbox CE Post-Authentication Command Injection

    YüksekCVSS 8,8SilahlaştırılmışEPSS %65

    netfortris · trixbox1 May 2020

  • CVE-2020-1631
    70Bu hafta

    Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %4

    juniper · junos4 May 2020

  • CVE-2020-12110
    43Planlayın

    Certain TP-Link devices have a Hardcoded Encryption Key.

    KritikCVSS 9,8İstismar yokEPSS %13

    tp-link · nc200 firmware4 May 2020

  • CVE-2020-12641
    94Hemen

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %84

    roundcube · webmail4 May 2020

  • CVE-2020-12109
    57Planlayın

    Certain TP-Link devices allow Command Injection.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %74

    tp-link · nc200 firmware4 May 2020

  • CVE-2020-2184
    30İzleyin

    A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to con

    OrtaCVSS 4,3İstismar yokEPSS %44

    jenkins · current versions systems6 May 2020

  • CVE-2020-7806
    39İzleyin

    Tobesoft Xplatform ActiveX File Download Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    tobesoft · xplatform6 May 2020

  • CVE-2020-3187
    65Bu hafta

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability

    KritikCVSS 9,1Kavram kanıtıEPSS %96

    cisco · secure firewall threat defense6 May 2020

  • CVE-2020-3259
    82Hemen

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %71

    cisco · secure firewall threat defense6 May 2020

  • CVE-2020-7473
    34İzleyin

    In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releas

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    citrix · sharefile storagezones controller7 May 2020

  • CVE-2020-8982
    38İzleyin

    An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, includi

    YüksekCVSS 7,5Kavram kanıtıEPSS %27

    citrix · sharefile storagezones controller7 May 2020

  • CVE-2020-12608
    38İzleyin

    An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent.

    YüksekCVSS 7,8Kavram kanıtıEPSS %22

    solarwinds · managed service provider patch management engine7 May 2020

  • CVE-2020-12116
    59Planlayın

    Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary

    YüksekCVSS 7,5Kavram kanıtıEPSS %97

    zohocorp · manageengine opmanager7 May 2020

  • CVE-2020-4427
    90Hemen

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when config

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %70

    ibm · data risk manager7 May 2020

  • CVE-2020-4428
    85Hemen

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %61

    ibm · data risk manager7 May 2020

  • CVE-2020-4429
    61Bu hafta

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account.

    KritikCVSS 9,8SilahlaştırılmışEPSS %71

    ibm · data risk manager7 May 2020

  • CVE-2020-4430
    68Bu hafta

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system.

    OrtaCVSS 4,3KEVSilahlaştırılmışEPSS %68

    ibm · data risk manager7 May 2020

  • CVE-2020-12720
    66Bu hafta

    vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

    KritikCVSS 9,8SilahlaştırılmışEPSS %88

    vbulletin · vbulletin7 May 2020

  • CVE-2020-5741
    80Hemen

    Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %72

    plex · media server8 May 2020

  • CVE-2020-11530
    68Bu hafta

    A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.

    KritikCVSS 9,8SilahlaştırılmışEPSS %95

    idangero · chop slider8 May 2020

  • CVE-2020-11531
    39İzleyin

    The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name whe

    YüksekCVSS 8,8İstismar yokEPSS %13

    zohocorp · manageengine adaudit plus8 May 2020

  • CVE-2020-11532
    62Bu hafta

    Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server.

    KritikCVSS 9,8SilahlaştırılmışEPSS %77

    zohocorp · manageengine adaudit plus8 May 2020

  • CVE-2020-9315
    55Planlayın

    ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Admi

    YüksekCVSS 7,5Kavram kanıtıEPSS %81

    oracle · iplanet web server10 May 2020

  • CVE-2020-11108
    58Planlayın

    The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %78

    pi-hole · pi-hole11 May 2020

  • CVE-2018-1285
    44Planlayın

    Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    apache · log4net11 May 2020

  • CVE-2020-10021
    31İzleyin

    Out-of-bounds write in USB Mass Storage with unaligned sizes

    YüksekCVSS 7,8İstismar yokEPSS %0

    zephyrproject · zephyr11 May 2020

  • CVE-2020-11060
    38İzleyin

    Remote Code Execution in GLPI

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    glpi-project · glpi12 May 2020

  • CVE-2019-16112
    38İzleyin

    TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/Se

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    tylertech · eagle13 May 2020

  • CVE-2020-11971
    34İzleyin

    Apache Camel's JMX is vulnerable to Rebind Flaw.

    YüksekCVSS 7,5İstismar yokEPSS %13

    apache · camel14 May 2020

  • CVE-2020-12834
    42Planlayın

    eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.ru

    KritikCVSS 9,8İstismar yokEPSS %11

    eq-3 · homematic ccu2 firmware15 May 2020

  • CVE-2020-12259
    50Planlayın

    rConfig 3.9.4 is vulnerable to reflected XSS.

    OrtaCVSS 5,4Kavram kanıtıEPSS %96

    rconfig · rconfig18 May 2020

  • CVE-2020-12255
    51Planlayın

    rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality.

    YüksekCVSS 8,8Kavram kanıtıEPSS %52

    rconfig · rconfig18 May 2020

  • CVE-2020-12256
    50Planlayın

    rConfig 3.9.4 is vulnerable to reflected XSS.

    OrtaCVSS 5,4Kavram kanıtıEPSS %95

    rconfig · rconfig18 May 2020

  • CVE-2020-6074
    48Planlayın

    An exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155.

    YüksekCVSS 8,8İstismar yokEPSS %41

    gonitro · nitro pro18 May 2020

  • CVE-2020-6092
    44Planlayın

    An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects.

    YüksekCVSS 7,8İstismar yokEPSS %43

    gonitro · nitro pro18 May 2020

  • CVE-2020-13144
    38İzleyin

    Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New uni

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    edx · open edx platform18 May 2020

  • CVE-2020-8616
    37İzleyin

    BIND does not sufficiently limit the number of fetches performed when processing referrals

    YüksekCVSS 8,6İstismar yokEPSS %10

    isc · bind19 May 2020

  • CVE-2020-8617
    51Planlayın

    A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

    OrtaCVSS 5,9SilahlaştırılmışEPSS %93

    isc · bind19 May 2020

  • CVE-2020-10030
    42Planlayın

    An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0.

    YüksekCVSS 8,8İstismar yokEPSS %23

    powerdns · recursor19 May 2020

  • CVE-2020-13166
    62Bu hafta

    The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all

    KritikCVSS 9,8SilahlaştırılmışEPSS %77

    mylittletools · mylittleadmin19 May 2020

  • CVE-2020-13167
    67Bu hafta

    Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) la

    KritikCVSS 9,8SilahlaştırılmışEPSS %94

    netsweeper · netsweeper19 May 2020

  • CVE-2020-12835
    43Planlayın

    An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5.

    KritikCVSS 9,8İstismar yokEPSS %13

    smartbear · readyapi20 May 2020

  • CVE-2020-3956
    41Planlayın

    VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly han

    YüksekCVSS 8,8Kavram kanıtıEPSS %21

    vmware · vcloud director20 May 2020

  • CVE-2020-9484
    45Planlayın

    When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able

    YüksekCVSS 7,0Kavram kanıtıEPSS %55

    apache · tomcat20 May 2020

  • CVE-2020-5752
    34İzleyin

    Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system

    YüksekCVSS 7,8SilahlaştırılmışEPSS %8

    druva · insync client21 May 2020

  • CVE-2020-1048
    36İzleyin

    Windows Print Spooler Elevation of Privilege Vulnerability

    YüksekCVSS 7,8SilahlaştırılmışEPSS %16

    microsoft · windows 1021 May 2020

  • CVE-2020-1118
    39İzleyin

    Microsoft Windows Transport Layer Security Denial of Service Vulnerability

    YüksekCVSS 8,6İstismar yokEPSS %15

    microsoft · windows 1021 May 2020

  • CVE-2020-1054
    74Bu hafta

    Win32k Elevation of Privilege Vulnerability

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %53

    microsoft · windows 10 150721 May 2020

  • CVE-2020-1956
    94Hemen

    Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %97

    apache · kylin22 May 2020

  • CVE-2020-8604
    57Planlayın

    A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on

    YüksekCVSS 7,5SilahlaştırılmışEPSS %89

    trendmicro · interscan web security virtual appliance27 May 2020

  • CVE-2020-8605
    61Bu hafta

    A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected

    YüksekCVSS 8,8SilahlaştırılmışEPSS %87

    trendmicro · interscan web security virtual appliance27 May 2020

  • CVE-2020-8606
    61Bu hafta

    A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected

    KritikCVSS 9,8SilahlaştırılmışEPSS %73

    trendmicro · interscan web security virtual appliance27 May 2020

  • CVE-2020-13693
    52Planlayın

    An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    bbpress · bbpress28 May 2020

  • CVE-2020-8816
    81Hemen

    Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %78

    pi-hole · pi-hole29 May 2020