İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2020: sömürülen ve yeni ciddi CVE kayıtları

57 kayıt · 8 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2019-5645
    43Planlayın

    Rapid7 Metasploit HTTP Handler Denial of Service

    YüksekCVSS 7,5SilahlaştırılmışEPSS %41

    rapid7 · metasploit1 Eyl 2020

  • CVE-2020-23839
    27İzleyin

    A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote at

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    get-simple · getsimple cms1 Eyl 2020

  • CVE-2020-24557
    62Bu hafta

    A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %2

    microsoft · windows1 Eyl 2020

  • CVE-2020-5776
    39İzleyin

    Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens.

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    magmi project · magmi1 Eyl 2020

  • CVE-2020-5777
    46Planlayın

    MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a

    KritikCVSS 9,8Kavram kanıtıEPSS %23

    magmi project · magmi1 Eyl 2020

  • CVE-2020-25078
    89Hemen

    An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %97

    dlink · dcs-4603 firmware2 Eyl 2020

  • CVE-2020-25079
    81Hemen

    An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %54

    dlink · dcs-4703e firmware2 Eyl 2020

  • CVE-2020-14209
    43Planlayın

    Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution.

    YüksekCVSS 8,8Kavram kanıtıEPSS %27

    dolibarr · dolibarr2 Eyl 2020

  • CVE-2020-24949
    55Planlayın

    Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the

    YüksekCVSS 8,8Kavram kanıtıEPSS %67

    php-fusion · php-fusion3 Eyl 2020

  • CVE-2020-24948
    32İzleyin

    The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing

    YüksekCVSS 7,2İstismar yokEPSS %13

    autoptimize · autoptimize3 Eyl 2020

  • CVE-2020-25042
    34İzleyin

    An arbitrary file upload issue exists in Mara CMS 7.5.

    YüksekCVSS 7,2SilahlaştırılmışEPSS %18

    maracms · maracms3 Eyl 2020

  • CVE-2020-11579
    38İzleyin

    An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition.

    YüksekCVSS 7,5Kavram kanıtıEPSS %26

    php · php3 Eyl 2020

  • CVE-2020-3495
    53Planlayın

    Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %60

    cisco · jabber3 Eyl 2020

  • CVE-2020-14008
    40Planlayın

    Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location

    YüksekCVSS 7,2Kavram kanıtıEPSS %39

    zohocorp · manageengine applications manager4 Eyl 2020

  • CVE-2020-11117
    45Planlayın

    u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resul

    KritikCVSS 9,8İstismar yokEPSS %19

    qualcomm · ipq4019 firmware8 Eyl 2020

  • CVE-2020-25213
    98Hemen

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    filemanagerpro · file manager9 Eyl 2020

  • CVE-2020-2036
    42Planlayın

    PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface

    YüksekCVSS 8,8Kavram kanıtıEPSS %23

    paloaltonetworks · pan-os9 Eyl 2020

  • CVE-2020-2038
    54Planlayın

    PAN-OS: OS command injection vulnerability in the management web interface

    YüksekCVSS 7,2SilahlaştırılmışEPSS %86

    paloaltonetworks · pan-os9 Eyl 2020

  • CVE-2020-2039
    35İzleyin

    PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload

    OrtaCVSS 5,3İstismar yokEPSS %46

    paloaltonetworks · pan-os9 Eyl 2020

  • CVE-2020-24916
    44Planlayın

    CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.

    KritikCVSS 9,8İstismar yokEPSS %17

    yaws · yaws9 Eyl 2020

  • CVE-2020-17408
    51Planlayın

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1.

    YüksekCVSS 7,5İstismar yokEPSS %69

    nec · expresscluster x10 Eyl 2020

  • CVE-2020-11998
    54Planlayın

    A regression has been introduced in the commit preventing JMX re-bind.

    KritikCVSS 9,8Kavram kanıtıEPSS %48

    apache · activemq10 Eyl 2020

  • CVE-2020-9731
    34İzleyin

    Out-of-bounds memory access could lead to code execution

    YüksekCVSS 7,8İstismar yokEPSS %11

    adobe · indesign10 Eyl 2020

  • CVE-2020-11991
    52Planlayın

    When using the StreamGenerator, the code parse a user-provided XML.

    YüksekCVSS 7,5Kavram kanıtıEPSS %72

    apache · cocoon11 Eyl 2020

  • CVE-2020-0878
    47Planlayın

    Microsoft Browser Memory Corruption Vulnerability

    OrtaCVSS 4,2KEVSilahlaştırılmışEPSS %2

    microsoft · internet explorer11 Eyl 2020

  • CVE-2020-16875
    47Planlayın

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,4SilahlaştırılmışEPSS %46

    microsoft · exchange server11 Eyl 2020

  • CVE-2020-1074
    45Planlayın

    Jet Database Engine Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %46

    microsoft · windows 1011 Eyl 2020

  • CVE-2020-25540
    53Planlayın

    ThinkAdmin v6 is affected by a directory traversal vulnerability.

    YüksekCVSS 7,5Kavram kanıtıEPSS %75

    thinkadmin · thinkadmin14 Eyl 2020

  • CVE-2019-0230
    68Bu hafta

    Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exe

    KritikCVSS 9,8SilahlaştırılmışEPSS %96

    apache · struts14 Eyl 2020

  • CVE-2019-0233
    50Planlayın

    An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

    YüksekCVSS 7,5İstismar yokEPSS %66

    apache · struts14 Eyl 2020

  • CVE-2020-15148
    63Bu hafta

    Unsafe deserialization in Yii 2

    KritikCVSS 10,0Kavram kanıtıEPSS %77

    yiiframework · yii15 Eyl 2020

  • CVE-2020-6146
    58Planlayın

    An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300.

    YüksekCVSS 8,8İstismar yokEPSS %75

    gonitro · nitro pro16 Eyl 2020

  • CVE-2020-14181
    51Planlayın

    Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu

    OrtaCVSS 5,3SilahlaştırılmışEPSS %99

    atlassian · data center16 Eyl 2020

  • CVE-2020-6112
    36İzleyin

    An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2

    YüksekCVSS 7,8İstismar yokEPSS %17

    gonitro · nitro pro17 Eyl 2020

  • CVE-2020-6113
    50Planlayın

    An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating

    YüksekCVSS 7,8İstismar yokEPSS %64

    gonitro · nitro pro17 Eyl 2020

  • CVE-2020-6116
    40Planlayın

    An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242.

    YüksekCVSS 7,8İstismar yokEPSS %28

    gonitro · nitro pro17 Eyl 2020

  • CVE-2020-13944
    32İzleyin

    In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

    OrtaCVSS 6,1İstismar yokEPSS %25

    apache · airflow17 Eyl 2020

  • CVE-2020-11698
    61Bu hafta

    An issue was discovered in Titan SpamTitan 7.07.

    KritikCVSS 9,8SilahlaştırılmışEPSS %73

    titanhq · spamtitan17 Eyl 2020

  • CVE-2020-5421
    29İzleyin

    RFD Protection Bypass via jsessionid

    OrtaCVSS 6,5Kavram kanıtıEPSS %11

    vmware · spring framework19 Eyl 2020

  • CVE-2020-25787
    45Planlayın

    An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    tt-rss · tiny tiny rss19 Eyl 2020

  • CVE-2020-25790
    33İzleyin

    Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive.

    YüksekCVSS 7,2Kavram kanıtıEPSS %15

    typesettercms · typesetter19 Eyl 2020

  • CVE-2020-14179
    44Planlayın

    Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA

    OrtaCVSS 5,3Kavram kanıtıEPSS %76

    atlassian · jira data center20 Eyl 2020

  • CVE-2020-6541
    41Planlayın

    Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a craf

    YüksekCVSS 8,8İstismar yokEPSS %21

    google · chrome21 Eyl 2020

  • CVE-2020-6549
    43Planlayın

    Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft

    YüksekCVSS 8,8İstismar yokEPSS %27

    google · chrome21 Eyl 2020

  • CVE-2020-6550
    43Planlayın

    Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a c

    YüksekCVSS 8,8İstismar yokEPSS %27

    google · chrome21 Eyl 2020

  • CVE-2020-6551
    43Planlayın

    Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft

    YüksekCVSS 8,8İstismar yokEPSS %27

    google · chrome21 Eyl 2020

  • CVE-2020-11855
    31İzleyin

    An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %1

    microfocus · operation bridge reporter22 Eyl 2020

  • CVE-2020-11857
    44Planlayın

    An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.

    KritikCVSS 9,8SilahlaştırılmışEPSS %15

    microfocus · operation bridge reporter22 Eyl 2020

  • CVE-2019-15993
    24İzleyin

    Cisco Small Business Switches Information Disclosure Vulnerability

    OrtaCVSS 5,3Kavram kanıtıEPSS %10

    cisco · sg250x-24 firmware22 Eyl 2020

  • CVE-2020-3569
    65Bu hafta

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %3

    cisco · ios xr22 Eyl 2020

  • CVE-2020-24365
    38İzleyin

    An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices.

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    gemteks · wrtm-127acn firmware24 Eyl 2020

  • CVE-2020-15160
    42Planlayın

    Blind SQL Injection in PrestaShop

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    prestashop · prestashop24 Eyl 2020

  • CVE-2020-25223
    98Hemen

    A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %96

    sophos · unified threat management25 Eyl 2020

  • CVE-2018-5353
    42Planlayın

    The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    zohocorp · manageengine adselfservice plus30 Eyl 2020

  • CVE-2020-13951
    51Planlayın

    Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.

    YüksekCVSS 7,5Kavram kanıtıEPSS %68

    apache · openmeetings30 Eyl 2020

  • CVE-2020-25762
    39İzleyin

    An issue was discovered in SourceCodester Seat Reservation System 1.0.

    KritikCVSS 9,1Kavram kanıtıEPSS %11

    seat reservation system project · seat reservation system30 Eyl 2020

  • CVE-2020-8243
    85Hemen

    A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %90

    ivanti · connect secure30 Eyl 2020