İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2020: sömürülen ve yeni ciddi CVE kayıtları

74 kayıt · 9 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2020-8539
    40Planlayın

    Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unaut

    YüksekCVSS 7,8SilahlaştırılmışEPSS %2

    kia · head unit firmware1 Ara 2020

  • CVE-2020-29279
    55Planlayın

    PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 a

    KritikCVSS 9,8Kavram kanıtıEPSS %52

    74cms · 74cms2 Ara 2020

  • CVE-2020-26248
    36İzleyin

    Blind SQL injection during the CommentGrade process

    YüksekCVSS 8,2Kavram kanıtıEPSS %12

    prestashop · productcomments3 Ara 2020

  • CVE-2020-25649
    35İzleyin

    A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

    YüksekCVSS 7,5İstismar yokEPSS %17

    fasterxml · jackson-databind3 Ara 2020

  • CVE-2020-17527
    37İzleyin

    Apache Tomcat: Request header mix-up between HTTP/2 streams

    YüksekCVSS 7,5Kavram kanıtıEPSS %24

    apache · tomcat3 Ara 2020

  • CVE-2020-13945
    48Planlayın

    In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %72

    apache · apisix7 Ara 2020

  • CVE-2020-29597
    60Bu hafta

    IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %71

    incomcms project · incomcms7 Ara 2020

  • CVE-2020-27930
    68Bu hafta

    A memory corruption issue was addressed with improved input validation.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %22

    apple · ipados8 Ara 2020

  • CVE-2020-27932
    64Bu hafta

    A type confusion issue was addressed with improved state handling.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %10

    apple · icloud8 Ara 2020

  • CVE-2020-27950
    57Planlayın

    A memory initialization issue was addressed.

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %16

    apple · ipados8 Ara 2020

  • CVE-2020-26950
    60Bu hafta

    In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condi

    YüksekCVSS 8,8SilahlaştırılmışEPSS %42

    mozilla · firefox8 Ara 2020

  • CVE-2020-17096
    36İzleyin

    Windows NTFS Remote Code Execution Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %19

    microsoft · windows 109 Ara 2020

  • CVE-2020-17103
    35İzleyin

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,0Kavram kanıtıEPSS %22

    microsoft · windows 109 Ara 2020

  • CVE-2020-17117
    41Planlayın

    Microsoft Exchange Remote Code Execution Vulnerability

    OrtaCVSS 6,6İstismar yokEPSS %48

    microsoft · exchange server9 Ara 2020

  • CVE-2020-17132
    63Bu hafta

    Microsoft Exchange Remote Code Execution Vulnerability

    KritikCVSS 9,1SilahlaştırılmışEPSS %89

    microsoft · exchange server9 Ara 2020

  • CVE-2020-17136
    40Planlayın

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8SilahlaştırılmışEPSS %13

    microsoft · windows 109 Ara 2020

  • CVE-2020-17140
    37İzleyin

    Windows SMB Information Disclosure Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %15

    microsoft · windows 109 Ara 2020

  • CVE-2020-17143
    56Planlayın

    Microsoft Exchange Server Information Disclosure Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %70

    microsoft · exchange server9 Ara 2020

  • CVE-2020-17144
    74Bu hafta

    Microsoft Exchange Remote Code Execution Vulnerability

    YüksekCVSS 8,4KEVSilahlaştırılmışEPSS %36

    microsoft · exchange server9 Ara 2020

  • CVE-2020-17530
    98Hemen

    Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95

    apache · struts10 Ara 2020

  • CVE-2020-26413
    31İzleyin

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2.

    OrtaCVSS 5,3Kavram kanıtıEPSS %34

    gitlab · gitlab11 Ara 2020

  • CVE-2020-17515
    29İzleyin

    The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

    OrtaCVSS 6,1İstismar yokEPSS %16

    apache · airflow11 Ara 2020

  • CVE-2020-29574
    70Bu hafta

    An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL s

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %4

    sophos · cyberoamos11 Ara 2020

  • CVE-2020-17438
    45Planlayın

    An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products.

    KritikCVSS 9,8İstismar yokEPSS %19

    uip project · uip11 Ara 2020

  • CVE-2020-24336
    57Planlayın

    An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5.

    KritikCVSS 9,8İstismar yokEPSS %59

    contiki-ng · contiki-ng11 Ara 2020

  • CVE-2020-24338
    50Planlayın

    An issue was discovered in picoTCP through 1.7.0.

    KritikCVSS 9,8İstismar yokEPSS %37

    altran · picotcp11 Ara 2020

  • CVE-2020-25107
    55Planlayın

    An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1.

    KritikCVSS 9,8İstismar yokEPSS %53

    ethernut · nut\/os11 Ara 2020

  • CVE-2020-25108
    55Planlayın

    An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1.

    KritikCVSS 9,8İstismar yokEPSS %53

    ethernut · nut\/os11 Ara 2020

  • CVE-2020-25109
    55Planlayın

    An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1.

    KritikCVSS 9,8İstismar yokEPSS %53

    ethernut · nut\/os11 Ara 2020

  • CVE-2020-25110
    55Planlayın

    An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1.

    KritikCVSS 9,8İstismar yokEPSS %53

    ethernut · nut\/os11 Ara 2020

  • CVE-2020-25111
    45Planlayın

    An issue was discovered in the IPv6 stack in Contiki through 3.0.

    KritikCVSS 9,8İstismar yokEPSS %20

    contiki-os · contiki-os11 Ara 2020

  • CVE-2020-25112
    47Planlayın

    An issue was discovered in the IPv6 stack in Contiki through 3.0.

    KritikCVSS 9,8İstismar yokEPSS %27

    contiki-os · contiki-os11 Ara 2020

  • CVE-2020-35234
    60Bu hafta

    The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %60

    wp-ecommerce · easy wp smtp13 Ara 2020

  • CVE-2020-35235
    40Planlayın

    vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper acc

    YüksekCVSS 8,8İstismar yokEPSS %18

    themexa · secure file manager13 Ara 2020

  • CVE-2020-29227
    44Planlayın

    An issue was discovered in Car Rental Management System 1.0.

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    car rental management system project · car rental management system14 Ara 2020

  • CVE-2020-35338
    42Planlayın

    The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default accou

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    mobileviewpoint · wireless multiplex terminal playout server14 Ara 2020

  • CVE-2020-10770
    42Planlayın

    A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter

    OrtaCVSS 5,3Kavram kanıtıEPSS %69

    redhat · keycloak15 Ara 2020

  • CVE-2020-26258
    55Planlayın

    Server-Side Forgery Request can be activated unmarshalling with XStream

    YüksekCVSS 7,7Kavram kanıtıEPSS %81

    xstream · xstream16 Ara 2020

  • CVE-2020-26259
    52Planlayın

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

    OrtaCVSS 6,8Kavram kanıtıEPSS %82

    xstream · xstream16 Ara 2020

  • CVE-2020-35476
    65Bu hafta

    A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter.

    KritikCVSS 9,8SilahlaştırılmışEPSS %85

    opentsdb · opentsdb16 Ara 2020

  • CVE-2020-29607
    38İzleyin

    A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through

    YüksekCVSS 7,2Kavram kanıtıEPSS %33

    pluck-cms · pluck16 Ara 2020

  • CVE-2020-35489
    67Bu hafta

    The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because

    KritikCVSS 10,0Kavram kanıtıEPSS %89

    rocklobster · contact form 717 Ara 2020

  • CVE-2020-8466
    58Planlayın

    A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method

    KritikCVSS 9,8İstismar yokEPSS %64

    trendmicro · interscan web security virtual appliance17 Ara 2020

  • CVE-2020-25494
    51Planlayın

    Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevel

    KritikCVSS 9,8Kavram kanıtıEPSS %39

    xinuos · openserver18 Ara 2020

  • CVE-2020-20277
    47Planlayın

    There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 du

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    troglobit · uftpd18 Ara 2020

  • CVE-2020-7200
    64Bu hafta

    A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6.

    KritikCVSS 9,8SilahlaştırılmışEPSS %81

    hp · systems insight manager18 Ara 2020

  • CVE-2020-17526
    37İzleyin

    Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on si

    YüksekCVSS 7,7Kavram kanıtıEPSS %23

    apache · airflow21 Ara 2020

  • CVE-2020-35606
    43Planlayın

    Arbitrary command execution can occur in Webmin through 1.962.

    YüksekCVSS 8,8Kavram kanıtıEPSS %28

    webmin · webmin21 Ara 2020

  • CVE-2018-15641
    21İzleyin

    Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote auth

    OrtaCVSS 5,4İstismar yokEPSS %0

    odoo · odoo22 Ara 2020

  • CVE-2020-13557
    56Planlayın

    A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527.

    YüksekCVSS 8,8İstismar yokEPSS %70

    foxitsoftware · foxit reader22 Ara 2020

  • CVE-2020-24581
    36İzleyin

    An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.

    YüksekCVSS 8,0İstismar yokEPSS %13

    dlink · dsl2888a firmware22 Ara 2020

  • CVE-2020-29583
    96Hemen

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %90

    zyxel · usg20-vpn firmware22 Ara 2020

  • CVE-2020-28070
    46Planlayın

    SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_even

    KritikCVSS 9,8İstismar yokEPSS %22

    alumni management system project · alumni management system23 Ara 2020

  • CVE-2020-35598
    36İzleyin

    ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI.

    YüksekCVSS 7,5Kavram kanıtıEPSS %20

    advanced comment system project · advanced comment system23 Ara 2020

  • CVE-2020-35665
    63Bu hafta

    An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter

    KritikCVSS 9,8SilahlaştırılmışEPSS %78

    terra-master · terramaster operating system23 Ara 2020

  • CVE-2020-28185
    26İzleyin

    User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the syste

    OrtaCVSS 5,3Kavram kanıtıEPSS %18

    terra-master · tos24 Ara 2020

  • CVE-2020-28187
    44Planlayın

    Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any f

    KritikCVSS 9,8İstismar yokEPSS %16

    terra-master · tos24 Ara 2020

  • CVE-2020-28188
    68Bu hafta

    Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /

    KritikCVSS 9,8SilahlaştırılmışEPSS %96

    terra-master · tos24 Ara 2020

  • CVE-2020-35713
    49Planlayın

    Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metach

    KritikCVSS 9,8Kavram kanıtıEPSS %32

    linksys · re6500 firmware25 Ara 2020

  • CVE-2020-35728
    36İzleyin

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wl

    YüksekCVSS 8,1Kavram kanıtıEPSS %12

    fasterxml · jackson-databind27 Ara 2020

  • CVE-2020-35729
    65Bu hafta

    KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

    KritikCVSS 9,8SilahlaştırılmışEPSS %88

    klogserver · klog server27 Ara 2020

  • CVE-2020-35736
    35İzleyin

    GateOne 1.1 allows arbitrary file download without authentication via /downloads/..

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    liftoffsoftware · gateone27 Ara 2020

  • CVE-2020-35613
    48Planlayın

    [20201104] - Core - SQL injection in com_users list view

    KritikCVSS 9,8İstismar yokEPSS %28

    joomla · joomla\!28 Ara 2020

  • CVE-2020-35730
    64Bu hafta

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %32

    roundcube · webmail28 Ara 2020

  • CVE-2020-5801
    39İzleyin

    An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDMana

    YüksekCVSS 7,5İstismar yokEPSS %29

    rockwellautomation · factorytalk linx29 Ara 2020

  • CVE-2020-5802
    43Planlayın

    An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted Configure

    YüksekCVSS 7,5İstismar yokEPSS %44

    rockwellautomation · factorytalk linx29 Ara 2020

  • CVE-2020-5807
    42Planlayın

    An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics ev

    YüksekCVSS 7,5İstismar yokEPSS %39

    rockwellautomation · factorytalk diagnostics29 Ara 2020

  • CVE-2020-35774
    47Planlayın

    server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS

    OrtaCVSS 5,4Kavram kanıtıEPSS %85

    twitter · twitter-server29 Ara 2020

  • CVE-2020-10148
    97Hemen

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91

    solarwinds · orion platform29 Ara 2020

  • CVE-2020-35846
    67Bu hafta

    Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

    KritikCVSS 9,8SilahlaştırılmışEPSS %93

    agentejo · cockpit29 Ara 2020

  • CVE-2020-35847
    68Bu hafta

    Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

    KritikCVSS 9,8SilahlaştırılmışEPSS %98

    agentejo · cockpit29 Ara 2020

  • CVE-2020-35848
    61Bu hafta

    Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

    KritikCVSS 9,8Kavram kanıtıEPSS %74

    agentejo · cockpit29 Ara 2020

  • CVE-2020-5810
    40Planlayın

    A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.

    OrtaCVSS 5,4İstismar yokEPSS %61

    umbraco · umbraco cms30 Ara 2020

  • CVE-2020-35737
    33İzleyin

    In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    newgensoft · egov30 Ara 2020