İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2020: sömürülen ve yeni ciddi CVE kayıtları

70 kayıt · 14 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2020-15227
    49Planlayın

    Remote Code Execution vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    nette · application1 Eki 2020

  • CVE-2020-15663
    36İzleyin

    If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location wi

    YüksekCVSS 8,8İstismar yokEPSS %2

    mozilla · firefox1 Eki 2020

  • CVE-2020-12124
    61Bu hafta

    A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an atta

    KritikCVSS 9,8Kavram kanıtıEPSS %74

    wavlink · wn530h4 firmware2 Eki 2020

  • CVE-2020-26124
    55Planlayın

    openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %66

    openmediavault · openmediavault2 Eki 2020

  • CVE-2020-24397
    33İzleyin

    An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534.

    YüksekCVSS 7,2İstismar yokEPSS %15

    zohocorp · manageengine desktop central2 Eki 2020

  • CVE-2020-26525
    44Planlayın

    Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter.

    KritikCVSS 9,1Kavram kanıtıEPSS %25

    damstratechnology · smart asset2 Eki 2020

  • CVE-2020-24214
    50Planlayın

    An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.

    KritikCVSS 9,8Kavram kanıtıEPSS %35

    szuray · iptv\/h.264 video encoder firmware6 Eki 2020

  • CVE-2020-24215
    45Planlayın

    An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    szuray · iptv\/h.264 video encoder firmware6 Eki 2020

  • CVE-2020-24217
    51Planlayın

    An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.

    KritikCVSS 9,8Kavram kanıtıEPSS %40

    szuray · iptv\/h.264 video encoder firmware6 Eki 2020

  • CVE-2020-24219
    37İzleyin

    An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97.

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    szuray · iptv\/h.264 video encoder firmware6 Eki 2020

  • CVE-2020-15927
    47Planlayın

    Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP mo

    YüksekCVSS 8,8İstismar yokEPSS %41

    zohocorp · manageengine applications manager6 Eki 2020

  • CVE-2020-16267
    47Planlayın

    Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA mo

    YüksekCVSS 8,8İstismar yokEPSS %41

    zohocorp · manageengine applications manager6 Eki 2020

  • CVE-2020-26876
    33İzleyin

    The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materi

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    wpcoursesplugin · wp-courses7 Eki 2020

  • CVE-2020-15175
    57Planlayın

    Unauthenticated File Deletion in GLPI

    KritikCVSS 9,1Kavram kanıtıEPSS %71

    glpi-project · glpi7 Eki 2020

  • CVE-2020-26567
    27İzleyin

    An issue was discovered on D-Link DSR-250N before 3.17B devices.

    OrtaCVSS 5,5Kavram kanıtıEPSS %16

    dlink · dsr-250n firmware8 Eki 2020

  • CVE-2020-13340
    54Planlayın

    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

    YüksekCVSS 8,7İstismar yokEPSS %66

    gitlab · gitlab8 Eki 2020

  • CVE-2020-4280
    57Planlayın

    IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of

    YüksekCVSS 8,8İstismar yokEPSS %72

    ibm · qradar security information and event manager8 Eki 2020

  • CVE-2020-26919
    86Hemen

    NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %57

    netgear · jgs516pe firmware9 Eki 2020

  • CVE-2020-26935
    59Planlayın

    An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3.

    KritikCVSS 9,8Kavram kanıtıEPSS %65

    phpmyadmin · phpmyadmin10 Eki 2020

  • CVE-2020-26948
    65Bu hafta

    Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

    KritikCVSS 9,8SilahlaştırılmışEPSS %87

    emby · emby10 Eki 2020

  • CVE-2020-5135
    77Bu hafta

    A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %26

    sonicwall · sonicos12 Eki 2020

  • CVE-2020-8821
    45Planlayın

    An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint.

    OrtaCVSS 5,4İstismar yokEPSS %79

    webmin · webmin12 Eki 2020

  • CVE-2020-13943
    33İzleyin

    If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nu

    OrtaCVSS 4,3İstismar yokEPSS %54

    apache · tomcat12 Eki 2020

  • CVE-2019-17444
    60Bu hafta

    JFrog Artifactory does not enforce default admin password change

    KritikCVSS 9,8Kavram kanıtıEPSS %69

    jfrog · artifactory12 Eki 2020

  • CVE-2020-17410
    35İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798.

    YüksekCVSS 7,8İstismar yokEPSS %12

    foxitsoftware · foxit reader13 Eki 2020

  • CVE-2020-17416
    35İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.0.35798.

    YüksekCVSS 7,8İstismar yokEPSS %12

    foxitsoftware · foxit reader13 Eki 2020

  • CVE-2020-17417
    35İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811.

    YüksekCVSS 7,8İstismar yokEPSS %12

    foxitsoftware · foxit reader13 Eki 2020

  • CVE-2020-13957
    63Bu hafta

    Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for

    KritikCVSS 9,8Kavram kanıtıEPSS %79

    apache · solr13 Eki 2020

  • CVE-2020-12503
    35İzleyin

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    YüksekCVSS 7,2İstismar yokEPSS %22

    pepperl-fuchs · es7510-xt firmware15 Eki 2020

  • CVE-2020-14144
    57Planlayın

    The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the do

    YüksekCVSS 7,2SilahlaştırılmışEPSS %95

    gitea · gitea16 Eki 2020

  • CVE-2020-15867
    54Planlayın

    The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution.

    YüksekCVSS 7,2SilahlaştırılmışEPSS %87

    gogs · gogs16 Eki 2020

  • CVE-2020-16270
    28İzleyin

    OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS.

    OrtaCVSS 6,1Kavram kanıtıEPSS %13

    olimpoks · olimpok16 Eki 2020

  • CVE-2020-9907
    62Bu hafta

    A memory corruption issue was addressed by removing the vulnerable code.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    apple · ipados16 Eki 2020

  • CVE-2020-9934
    53Planlayın

    An issue existed in the handling of environment variables.

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %3

    apple · ipados16 Eki 2020

  • CVE-2020-16896
    34İzleyin

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %12

    microsoft · windows 1016 Eki 2020

  • CVE-2020-16898
    38İzleyin

    Windows TCP/IP Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    microsoft · windows 1016 Eki 2020

  • CVE-2020-16899
    34İzleyin

    Windows TCP/IP Denial of Service Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    microsoft · windows 1016 Eki 2020

  • CVE-2020-16947
    40Planlayın

    Microsoft Outlook Remote Code Execution Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %33

    microsoft · 365 apps16 Eki 2020

  • CVE-2020-16952
    60Bu hafta

    Microsoft SharePoint Remote Code Execution Vulnerability

    YüksekCVSS 8,6SilahlaştırılmışEPSS %71

    microsoft · sharepoint enterprise server16 Eki 2020

  • CVE-2020-24648
    42Planlayın

    A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Managem

    KritikCVSS 9,8İstismar yokEPSS %10

    hp · intelligent management center19 Eki 2020

  • CVE-2020-13937
    44Planlayın

    Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3

    OrtaCVSS 5,3Kavram kanıtıEPSS %78

    apache · kylin19 Eki 2020

  • CVE-2020-15261
    29İzleyin

    Unquoted service path vulnerability on Veyon

    OrtaCVSS 6,7Kavram kanıtıEPSS %11

    veyon · veyon19 Eki 2020

  • CVE-2020-6308
    40Planlayın

    SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arb

    OrtaCVSS 5,3Kavram kanıtıEPSS %61

    sap · businessobjects business intelligence platform20 Eki 2020

  • CVE-2020-3992
    94Hemen

    OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %83

    vmware · cloud foundation20 Eki 2020

  • CVE-2020-5791
    52Planlayın

    Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute op

    YüksekCVSS 7,2SilahlaştırılmışEPSS %78

    nagios · nagios xi20 Eki 2020

  • CVE-2020-5792
    46Planlayın

    Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitra

    YüksekCVSS 7,2SilahlaştırılmışEPSS %58

    nagios · nagios xi20 Eki 2020

  • CVE-2020-25820
    29İzleyin

    BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document th

    OrtaCVSS 6,5Kavram kanıtıEPSS %10

    bigbluebutton · bigbluebutton21 Eki 2020

  • CVE-2020-14825
    48Planlayın

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    KritikCVSS 9,8İstismar yokEPSS %30

    oracle · weblogic server21 Eki 2020

  • CVE-2020-14841
    55Planlayın

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    KritikCVSS 9,8İstismar yokEPSS %52

    oracle · weblogic server21 Eki 2020

  • CVE-2020-14864
    89Hemen

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation).

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %97

    oracle · business intelligence21 Eki 2020

  • CVE-2020-14871
    94Hemen

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module).

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %80

    oracle · solaris21 Eki 2020

  • CVE-2020-14882
    99Hemen

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    oracle · weblogic server21 Eki 2020

  • CVE-2020-14883
    87Hemen

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %97

    oracle · weblogic server21 Eki 2020

  • CVE-2020-3580
    80Hemen

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %85

    cisco · secure firewall threat defense21 Eki 2020

  • CVE-2020-27615
    60Bu hafta

    The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip

    KritikCVSS 9,8SilahlaştırılmışEPSS %52

    loginizer · loginizer21 Eki 2020

  • CVE-2020-15906
    47Planlayın

    tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    tiki · tiki22 Eki 2020

  • CVE-2020-11853
    58Planlayın

    Arbitrary code execution vulnerability on multiple Micro Focus products

    YüksekCVSS 8,8SilahlaştırılmışEPSS %76

    microfocus · operation bridge manager22 Eki 2020

  • CVE-2020-26561
    39İzleyin

    Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of sprintf in create_dir in

    YüksekCVSS 8,8İstismar yokEPSS %11

    belkin · linksys wrt 160nl firmware23 Eki 2020

  • CVE-2020-26878
    38İzleyin

    Ruckus through 1.5.1.0.21 is affected by remote command injection.

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    commscope · ruckus vriot26 Eki 2020

  • CVE-2020-26879
    53Planlayın

    Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py.

    KritikCVSS 9,8Kavram kanıtıEPSS %45

    commscope · ruckus vriot26 Eki 2020

  • CVE-2020-8956
    40Planlayın

    Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.

    DüşükCVSS 3,3SilahlaştırılmışEPSS %1

    pulsesecure · pulse secure desktop27 Eki 2020

  • CVE-2020-11854
    61Bu hafta

    Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.

    KritikCVSS 9,8SilahlaştırılmışEPSS %74

    microfocus · application performance management27 Eki 2020

  • CVE-2020-11858
    40Planlayın

    Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %2

    microfocus · operations bridge27 Eki 2020

  • CVE-2020-8260
    87Hemen

    A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code e

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %96

    ivanti · connect secure28 Eki 2020

  • CVE-2018-19943
    57Planlayın

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

    OrtaCVSS 5,4KEVSilahlaştırılmışEPSS %21

    qnap · qts28 Eki 2020

  • CVE-2018-19949
    78Bu hafta

    If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %28

    qnap · qts28 Eki 2020

  • CVE-2018-19953
    63Bu hafta

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %28

    qnap · qts28 Eki 2020

  • CVE-2020-27986
    35İzleyin

    SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI.

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    sonarsource · sonarqube28 Eki 2020

  • CVE-2020-7384
    40Planlayın

    Client-Side Command Injection in Rapid7 Metasploit

    YüksekCVSS 7,8SilahlaştırılmışEPSS %30

    rapid7 · metasploit29 Eki 2020

  • CVE-2020-7373
    53Planlayın

    vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel

    KritikCVSS 9,8İstismar yokEPSS %45

    vbulletin · vbulletin30 Eki 2020