İçeriğe atla
Noroxi

Yayın tarihine göre

Haziran 2020: sömürülen ve yeni ciddi CVE kayıtları

81 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2020-13448
    40Planlayın

    QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server

    YüksekCVSS 8,8Kavram kanıtıEPSS %17

    quickbox · quickbox1 Haz 2020

  • CVE-2020-10136
    30İzleyin

    IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic

    OrtaCVSS 5,3Kavram kanıtıEPSS %28

    cisco · nx-os2 Haz 2020

  • CVE-2020-5410
    89Hemen

    Directory Traversal with spring-cloud-config-server

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %95

    vmware · spring cloud config2 Haz 2020

  • CVE-2020-7115
    58Planlayın

    The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass.

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    arubanetworks · clearpass policy manager3 Haz 2020

  • CVE-2020-13756
    54Planlayın

    Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelecto

    KritikCVSS 9,8Kavram kanıtıEPSS %49

    sabberworm · php css parser3 Haz 2020

  • CVE-2020-13782
    43Planlayın

    D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.

    YüksekCVSS 8,8İstismar yokEPSS %27

    dlink · dir-865l firmware3 Haz 2020

  • CVE-2020-7012
    40Planlayın

    Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %18

    elastic · kibana3 Haz 2020

  • CVE-2020-13379
    62Bu hafta

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue.

    YüksekCVSS 8,2Kavram kanıtıEPSS %99

    grafana · grafana3 Haz 2020

  • CVE-2020-10546
    65Bu hafta

    rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %87

    rconfig · rconfig4 Haz 2020

  • CVE-2020-10547
    50Planlayın

    rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %36

    rconfig · rconfig4 Haz 2020

  • CVE-2020-10548
    50Planlayın

    rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %36

    rconfig · rconfig4 Haz 2020

  • CVE-2020-10549
    49Planlayın

    rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %32

    rconfig · rconfig4 Haz 2020

  • CVE-2020-13777
    36İzleyin

    GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authent

    YüksekCVSS 7,4Kavram kanıtıEPSS %22

    gnu · gnutls4 Haz 2020

  • CVE-2020-13818
    41Planlayın

    In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

    YüksekCVSS 7,5İstismar yokEPSS %37

    zohocorp · manageengine opmanager4 Haz 2020

  • CVE-2020-11975
    48Planlayın

    Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execut

    KritikCVSS 9,8Kavram kanıtıEPSS %30

    apache · unomi5 Haz 2020

  • CVE-2020-9859
    61Bu hafta

    A memory consumption issue was addressed with improved memory handling.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    apple · ipados5 Haz 2020

  • CVE-2020-4448
    43Planlayın

    IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the sy

    KritikCVSS 9,8İstismar yokEPSS %12

    ibm · websphere application server5 Haz 2020

  • CVE-2020-4450
    49Planlayın

    IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specia

    KritikCVSS 9,8İstismar yokEPSS %34

    ibm · websphere application server5 Haz 2020

  • CVE-2020-10543
    35İzleyin

    Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer ove

    YüksekCVSS 8,2İstismar yokEPSS %11

    perl · perl5 Haz 2020

  • CVE-2020-12695
    35İzleyin

    The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delive

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    nec · wr8165n8 Haz 2020

  • CVE-2020-12800
    63Bu hafta

    The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code ex

    KritikCVSS 9,8SilahlaştırılmışEPSS %78

    codedropz · drag and drop multiple file upload - contact form 78 Haz 2020

  • CVE-2020-13432
    39İzleyin

    rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-p

    YüksekCVSS 7,5İstismar yokEPSS %30

    rejetto · http file server8 Haz 2020

  • CVE-2020-13965
    77Bu hafta

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %76

    roundcube · webmail8 Haz 2020

  • CVE-2020-13160
    63Bu hafta

    AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.

    KritikCVSS 9,8SilahlaştırılmışEPSS %80

    anydesk · anydesk9 Haz 2020

  • CVE-2020-9801
    40Planlayın

    A logic issue was addressed with improved restrictions.

    OrtaCVSS 5,3SilahlaştırılmışEPSS %1

    apple · safari9 Haz 2020

  • CVE-2020-9818
    66Bu hafta

    An out-of-bounds write issue was addressed with improved bounds checking.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %2

    apple · ipados9 Haz 2020

  • CVE-2020-9819
    60Bu hafta

    A memory consumption issue was addressed with improved memory handling.

    OrtaCVSS 4,3KEVSilahlaştırılmışEPSS %2

    apple · ipados9 Haz 2020

  • CVE-2020-9839
    40Planlayın

    A race condition was addressed with improved state handling.

    YüksekCVSS 7,0SilahlaştırılmışEPSS %3

    apple · ipados9 Haz 2020

  • CVE-2020-9850
    62Bu hafta

    A logic issue was addressed with improved restrictions.

    KritikCVSS 9,8SilahlaştırılmışEPSS %77

    apple · icloud9 Haz 2020

  • CVE-2020-9856
    40Planlayın

    This issue was addressed with improved checks.

    OrtaCVSS 5,3SilahlaştırılmışEPSS %1

    apple · mac os x9 Haz 2020

  • CVE-2020-10644
    60Bu hafta

    The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8

    YüksekCVSS 7,5SilahlaştırılmışEPSS %20

    inductiveautomation · ignition gateway9 Haz 2020

  • CVE-2020-12004
    60Bu hafta

    The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignit

    YüksekCVSS 7,5SilahlaştırılmışEPSS %13

    inductiveautomation · ignition gateway9 Haz 2020

  • CVE-2020-0986
    66Bu hafta

    An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %16

    microsoft · windows 10 15079 Haz 2020

  • CVE-2020-1181
    56Planlayın

    A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web

    YüksekCVSS 8,8İstismar yokEPSS %69

    microsoft · sharepoint enterprise server9 Haz 2020

  • CVE-2020-1206
    33İzleyin

    An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain req

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    microsoft · windows 109 Haz 2020

  • CVE-2020-1208
    35İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %14

    microsoft · windows 109 Haz 2020

  • CVE-2020-1219
    36İzleyin

    A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corr

    YüksekCVSS 7,5İstismar yokEPSS %19

    microsoft · internet explorer9 Haz 2020

  • CVE-2020-1225
    40Planlayın

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    YüksekCVSS 8,8İstismar yokEPSS %17

    microsoft · 365 apps9 Haz 2020

  • CVE-2020-1226
    40Planlayın

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    YüksekCVSS 8,8İstismar yokEPSS %17

    microsoft · 365 apps9 Haz 2020

  • CVE-2020-1236
    34İzleyin

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    YüksekCVSS 7,8İstismar yokEPSS %11

    microsoft · windows 109 Haz 2020

  • CVE-2020-1248
    39İzleyin

    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka

    YüksekCVSS 8,8İstismar yokEPSS %13

    microsoft · windows 109 Haz 2020

  • CVE-2020-1281
    39İzleyin

    A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code

    YüksekCVSS 8,8İstismar yokEPSS %14

    microsoft · windows 109 Haz 2020

  • CVE-2020-1286
    39İzleyin

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully explo

    YüksekCVSS 8,8İstismar yokEPSS %11

    microsoft · windows 109 Haz 2020

  • CVE-2020-1299
    39İzleyin

    A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An atta

    YüksekCVSS 8,8İstismar yokEPSS %14

    microsoft · windows 109 Haz 2020

  • CVE-2020-1300
    53Planlayın

    A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an

    YüksekCVSS 8,8İstismar yokEPSS %59

    microsoft · windows 109 Haz 2020

  • CVE-2020-1301
    48Planlayın

    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests,

    YüksekCVSS 8,8Kavram kanıtıEPSS %43

    microsoft · windows 109 Haz 2020

  • CVE-2020-1313
    43Planlayın

    An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows

    YüksekCVSS 7,8SilahlaştırılmışEPSS %38

    microsoft · windows 109 Haz 2020

  • CVE-2020-1321
    38İzleyin

    A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory, aka 'Microsoft

    YüksekCVSS 8,8İstismar yokEPSS %11

    microsoft · 365 apps9 Haz 2020

  • CVE-2020-11798
    36İzleyin

    A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an

    OrtaCVSS 5,3Kavram kanıtıEPSS %48

    mitel · micollab audio\, web \& video conferencing10 Haz 2020

  • CVE-2020-13851
    62Bu hafta

    Artica Pandora FMS 7.44 allows remote command execution via the events feature.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %90

    pandorafms · pandora fms10 Haz 2020

  • CVE-2020-13852
    36İzleyin

    Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.

    YüksekCVSS 7,2İstismar yokEPSS %27

    pandorafms · pandora fms10 Haz 2020

  • CVE-2020-13855
    36İzleyin

    Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.

    YüksekCVSS 7,2İstismar yokEPSS %27

    pandorafms · pandora fms10 Haz 2020

  • CVE-2020-4469
    43Planlayın

    IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system.

    KritikCVSS 9,8İstismar yokEPSS %13

    ibm · spectrum protect plus15 Haz 2020

  • CVE-2020-14011
    48Planlayın

    Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in

    KritikCVSS 9,8Kavram kanıtıEPSS %29

    lansweeper · lansweeper15 Haz 2020

  • CVE-2020-12001
    42Planlayın

    FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont

    KritikCVSS 9,8İstismar yokEPSS %11

    rockwellautomation · factorytalk linx15 Haz 2020

  • CVE-2020-11896
    51Planlayın

    The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

    KritikCVSS 10,0Kavram kanıtıEPSS %36

    treck · tcp\/ip17 Haz 2020

  • CVE-2020-11898
    42Planlayın

    The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers

    KritikCVSS 9,1Kavram kanıtıEPSS %18

    treck · tcp\/ip17 Haz 2020

  • CVE-2020-11899
    57Planlayın

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

    OrtaCVSS 5,4KEVSilahlaştırılmışEPSS %18

    treck · tcp\/ip17 Haz 2020

  • CVE-2020-11900
    36İzleyin

    The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.

    YüksekCVSS 8,2İstismar yokEPSS %13

    treck · tcp\/ip17 Haz 2020

  • CVE-2020-11901
    42Planlayın

    The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.

    KritikCVSS 9,0İstismar yokEPSS %21

    treck · tcp\/ip17 Haz 2020

  • CVE-2020-11910
    24İzleyin

    The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.

    OrtaCVSS 5,3İstismar yokEPSS %10

    treck · tcp\/ip17 Haz 2020

  • CVE-2020-14295
    54Planlayın

    A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter.

    YüksekCVSS 7,2SilahlaştırılmışEPSS %85

    cacti · cacti17 Haz 2020

  • CVE-2020-13640
    43Planlayın

    A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL comma

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    gvectors · wpdiscuz18 Haz 2020

  • CVE-2020-14422
    27İzleyin

    Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a

    OrtaCVSS 5,9İstismar yokEPSS %12

    python · python18 Haz 2020

  • CVE-2020-8165
    53Planlayın

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user

    KritikCVSS 9,8Kavram kanıtıEPSS %45

    rubyonrails · rails19 Haz 2020

  • CVE-2020-13158
    46Planlayın

    Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.

    YüksekCVSS 7,5Kavram kanıtıEPSS %53

    articatech · artica proxy22 Haz 2020

  • CVE-2020-11989
    46Planlayın

    Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    apache · shiro22 Haz 2020

  • CVE-2020-14945
    38İzleyin

    A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privi

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    globalradar · bsa radar22 Haz 2020

  • CVE-2020-12033
    35İzleyin

    In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied id

    YüksekCVSS 8,8İstismar yokEPSS %1

    rockwellautomation · factorytalk services platform23 Haz 2020

  • CVE-2020-9480
    48Planlayın

    In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) v

    KritikCVSS 9,8Kavram kanıtıEPSS %29

    apache · spark23 Haz 2020

  • CVE-2020-14005
    39İzleyin

    Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code

    YüksekCVSS 8,8İstismar yokEPSS %14

    solarwinds · orion network performance monitor24 Haz 2020

  • CVE-2020-13700
    34İzleyin

    An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress.

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    acf to rest api project · acf to rest api24 Haz 2020

  • CVE-2020-9597
    38İzleyin

    Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and

    YüksekCVSS 8,8İstismar yokEPSS %10

    adobe · acrobat dc25 Haz 2020

  • CVE-2020-9590
    43Planlayın

    Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability.

    YüksekCVSS 7,8İstismar yokEPSS %40

    adobe · digital negative software development kit26 Haz 2020

  • CVE-2020-11996
    38İzleyin

    A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could t

    YüksekCVSS 7,5Kavram kanıtıEPSS %26

    apache · tomcat26 Haz 2020

  • CVE-2020-2021
    71Bu hafta

    PAN-OS: Authentication Bypass in SAML Authentication

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %4

    paloaltonetworks · pan-os29 Haz 2020

  • CVE-2020-13896
    25İzleyin

    The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVer

    OrtaCVSS 5,3İstismar yokEPSS %14

    maipu · mp1800x-50 firmware29 Haz 2020

  • CVE-2020-15069
    72Bu hafta

    Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientles

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %10

    sophos · xg firewall firmware29 Haz 2020

  • CVE-2020-15415
    94Hemen

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution v

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %84

    draytek · vigor3900 firmware30 Haz 2020

  • CVE-2020-9483
    40Planlayın

    **Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vuln

    YüksekCVSS 7,5Kavram kanıtıEPSS %34

    apache · skywalking30 Haz 2020

  • CVE-2020-14947
    41Planlayın

    OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plu

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    factorfx · open computer software inventory next generation30 Haz 2020