İçeriğe atla
Noroxi

Yayın tarihine göre

Ağustos 2020: sömürülen ve yeni ciddi CVE kayıtları

51 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2020-15956
    35İzleyin

    ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and applic

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    acti · nvr4 Ağu 2020

  • CVE-2020-13151
    65Bu hafta

    Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as

    KritikCVSS 9,8SilahlaştırılmışEPSS %86

    aerospike · aerospike server5 Ağu 2020

  • CVE-2020-13921
    49Planlayın

    **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

    KritikCVSS 9,8İstismar yokEPSS %33

    apache · skywalking5 Ağu 2020

  • CVE-2020-7352
    40Planlayın

    GOG Galaxy GalaxyClientService Privilege Escalation

    YüksekCVSS 8,8SilahlaştırılmışEPSS %3

    gog · galaxy6 Ağu 2020

  • CVE-2020-7356
    60Bu hafta

    Cayin xPost SQL Injection

    KritikCVSS 9,8SilahlaştırılmışEPSS %14

    cayintech · xpost6 Ağu 2020

  • CVE-2020-7357
    49Planlayın

    Cayin CMS Command Injection

    KritikCVSS 9,9SilahlaştırılmışEPSS %32

    cayintech · cms-se firmware6 Ağu 2020

  • CVE-2020-7361
    40Planlayın

    ZenTao Pro Command Injection

    YüksekCVSS 8,8SilahlaştırılmışEPSS %17

    easycorp · zentao pro6 Ağu 2020

  • CVE-2020-11984
    66Bu hafta

    Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

    KritikCVSS 9,8Kavram kanıtıEPSS %90

    apache · http server7 Ağu 2020

  • CVE-2020-11993
    47Planlayın

    Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, loggin

    YüksekCVSS 7,5İstismar yokEPSS %56

    apache · http server7 Ağu 2020

  • CVE-2020-9490
    57Planlayın

    Apache HTTP Server versions 2.4.20 to 2.4.43.

    YüksekCVSS 7,5İstismar yokEPSS %88

    apache · http server7 Ağu 2020

  • CVE-2020-5412
    29İzleyin

    Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard

    OrtaCVSS 6,5Kavram kanıtıEPSS %10

    vmware · spring cloud netflix7 Ağu 2020

  • CVE-2020-17466
    39İzleyin

    Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses.

    KritikCVSS 9,8İstismar yokEPSS %1

    turcom · trcwifizone11 Ağu 2020

  • CVE-2020-17496
    95Hemen

    vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %87

    vbulletin · vbulletin12 Ağu 2020

  • CVE-2020-2230
    46Planlayın

    Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site

    OrtaCVSS 5,4Kavram kanıtıEPSS %82

    jenkins · jenkins12 Ağu 2020

  • CVE-2020-17505
    60Bu hafta

    Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %82

    articatech · web proxy12 Ağu 2020

  • CVE-2020-17506
    67Bu hafta

    Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQ

    KritikCVSS 9,8SilahlaştırılmışEPSS %93

    articatech · web proxy12 Ağu 2020

  • CVE-2020-7374
    40Planlayın

    Documalis Free PDF Editor / Free PDF Scanner Stack Based Buffer Overflow

    YüksekCVSS 7,8SilahlaştırılmışEPSS %3

    documalis · free pdf editor12 Ağu 2020

  • CVE-2020-16137
    60Bu hafta

    A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials

    KritikCVSS 9,8SilahlaştırılmışEPSS %19

    cisco · unified ip conference station 7937g firmware12 Ağu 2020

  • CVE-2020-16138
    60Bu hafta

    A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the devi

    YüksekCVSS 7,5SilahlaştırılmışEPSS %21

    cisco · unified ip conference station 7937g firmware12 Ağu 2020

  • CVE-2020-16139
    60Bu hafta

    A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely throug

    YüksekCVSS 7,5SilahlaştırılmışEPSS %79

    cisco · unified ip conference station 7937g firmware12 Ağu 2020

  • CVE-2020-17463
    96Hemen

    FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %89

    thedaylightstudio · fuel cms13 Ağu 2020

  • CVE-2020-16205
    46Planlayın

    Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1

    YüksekCVSS 7,2SilahlaştırılmışEPSS %61

    geutebrueck · g-cam ebc-2110 firmware14 Ağu 2020

  • CVE-2019-5591
    62Bu hafta

    A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %18

    fortinet · fortios14 Ağu 2020

  • CVE-2020-8209
    43Planlayın

    Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10

    YüksekCVSS 7,5Kavram kanıtıEPSS %43

    citrix · xenmobile server17 Ağu 2020

  • CVE-2020-3433
    64Bu hafta

    Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %10

    cisco · anyconnect secure mobility client17 Ağu 2020

  • CVE-2020-1337
    40Planlayın

    Windows Print Spooler Elevation of Privilege Vulnerability

    YüksekCVSS 7,8SilahlaştırılmışEPSS %14

    microsoft · windows 1017 Ağu 2020

  • CVE-2020-1380
    68Bu hafta

    Scripting Engine Memory Corruption Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %24

    microsoft · internet explorer17 Ağu 2020

  • CVE-2020-1464
    73Bu hafta

    Windows Spoofing Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %38

    microsoft · windows 10 150717 Ağu 2020

  • CVE-2020-1472
    82Hemen

    Netlogon Elevation of Privilege Vulnerability

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %99

    microsoft · windows server 190317 Ağu 2020

  • CVE-2020-13933
    43Planlayın

    Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

    YüksekCVSS 7,5Kavram kanıtıEPSS %44

    apache · shiro17 Ağu 2020

  • CVE-2020-23934
    40Planlayın

    An issue was discovered in RiteCMS 2.2.1.

    YüksekCVSS 8,8Kavram kanıtıEPSS %15

    ritecms · ritecms18 Ağu 2020

  • CVE-2020-9715
    71Bu hafta

    Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier hav

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %33

    adobe · acrobat dc19 Ağu 2020

  • CVE-2020-17456
    61Bu hafta

    SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.

    KritikCVSS 9,8Kavram kanıtıEPSS %73

    seowonintech · slc-130 firmware19 Ağu 2020

  • CVE-2020-23935
    44Planlayın

    Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)".

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    kabir-m-alhasan · student management system20 Ağu 2020

  • CVE-2020-24571
    35İzleyin

    NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    nexusdb · nexusdb21 Ağu 2020

  • CVE-2019-11855
    39İzleyin

    ALEOS LAN-Side RPC Server

    KritikCVSS 9,8İstismar yokEPSS %1

    sierrawireless · aleos21 Ağu 2020

  • CVE-2020-24589
    44Planlayın

    The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.

    KritikCVSS 9,1Kavram kanıtıEPSS %26

    wso2 · api manager21 Ağu 2020

  • CVE-2020-8227
    35İzleyin

    Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files ou

    OrtaCVSS 6,8İstismar yokEPSS %25

    nextcloud · desktop21 Ağu 2020

  • CVE-2020-24186
    68Bu hafta

    A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated u

    KritikCVSS 10,0SilahlaştırılmışEPSS %94

    gvectors · wpdiscuz24 Ağu 2020

  • CVE-2020-6637
    44Planlayın

    openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    os4ed · opensis24 Ağu 2020

  • CVE-2020-15639
    42Planlayın

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

    KritikCVSS 9,8İstismar yokEPSS %11

    marvell · qconvergeconsole25 Ağu 2020

  • CVE-2020-15643
    53Planlayın

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

    YüksekCVSS 8,8İstismar yokEPSS %58

    marvell · qconvergeconsole25 Ağu 2020

  • CVE-2020-15645
    38İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

    YüksekCVSS 8,8İstismar yokEPSS %10

    marvell · qconvergeconsole25 Ağu 2020

  • CVE-2020-17387
    38İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

    YüksekCVSS 8,8İstismar yokEPSS %10

    marvell · qconvergeconsole25 Ağu 2020

  • CVE-2020-17389
    38İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

    YüksekCVSS 8,8İstismar yokEPSS %10

    marvell · qconvergeconsole25 Ağu 2020

  • CVE-2020-24312
    35İzleyin

    mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file.

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    filemanagerpro · file manager26 Ağu 2020

  • CVE-2020-23972
    39İzleyin

    In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application a

    YüksekCVSS 7,5Kavram kanıtıEPSS %31

    gmapfp · gmapfp27 Ağu 2020

  • CVE-2020-3566
    65Bu hafta

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %3

    cisco · ios xr29 Ağu 2020

  • CVE-2020-24223
    28İzleyin

    Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.

    OrtaCVSS 6,1Kavram kanıtıEPSS %14

    mara cms project · mara cms30 Ağu 2020

  • CVE-2020-24786
    43Planlayın

    An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService

    KritikCVSS 9,8İstismar yokEPSS %12

    zohocorp · manageengine adselfservice plus31 Ağu 2020

  • CVE-2020-24363
    72Bu hafta

    TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %22

    tp-link · tl-wa855re firmware31 Ağu 2020