İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2021: sömürülen ve yeni ciddi CVE kayıtları

76 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2020-35948
    42Planlayın

    An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress.

    YüksekCVSS 8,8Kavram kanıtıEPSS %24

    xcloner · xcloner1 Oca 2021

  • CVE-2020-35951
    62Bu hafta

    An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.

    KritikCVSS 9,9Kavram kanıtıEPSS %76

    expresstech · quiz and survey master1 Oca 2021

  • CVE-2020-35391
    37İzleyin

    Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a dire

    OrtaCVSS 6,5Kavram kanıtıEPSS %35

    tenda · f3 firmware1 Oca 2021

  • CVE-2021-3007
    62Bu hafta

    Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execu

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    zend · zend framework3 Oca 2021

  • CVE-2020-36112
    44Planlayın

    CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in book

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    cse bookstore project · cse bookstore4 Oca 2021

  • CVE-2021-3018
    45Planlayın

    ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    ipeak · ipeakcms5 Oca 2021

  • CVE-2021-3019
    35İzleyin

    ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    lanproxy project · lanproxy5 Oca 2021

  • CVE-2020-17518
    45Planlayın

    Apache Flink directory traversal attack: remote file writing through the REST API

    YüksekCVSS 7,5Kavram kanıtıEPSS %49

    apache · flink5 Oca 2021

  • CVE-2020-17519
    89Hemen

    Apache Flink directory traversal attack: reading remote files through the REST API

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %97

    apache · flink5 Oca 2021

  • CVE-2021-21234
    36İzleyin

    spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint.

    YüksekCVSS 7,7Kavram kanıtıEPSS %21

    spring-boot-actuator-logview project · spring-boot-actuator-logview5 Oca 2021

  • CVE-2020-8264
    44Planlayın

    In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to s

    OrtaCVSS 6,1İstismar yokEPSS %66

    rubyonrails · rails6 Oca 2021

  • CVE-2020-8287
    31İzleyin

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-E

    OrtaCVSS 6,5Kavram kanıtıEPSS %16

    nodejs · node.js6 Oca 2021

  • CVE-2020-36179
    37İzleyin

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac

    YüksekCVSS 8,1Kavram kanıtıEPSS %17

    fasterxml · jackson-databind6 Oca 2021

  • CVE-2020-28672
    32İzleyin

    MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution.

    YüksekCVSS 7,2İstismar yokEPSS %12

    monocms · monocms7 Oca 2021

  • CVE-2021-23241
    25İzleyin

    MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication b

    OrtaCVSS 5,3Kavram kanıtıEPSS %13

    mercusys · mercury x18g firmware7 Oca 2021

  • CVE-2020-24577
    36İzleyin

    An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.

    YüksekCVSS 7,5İstismar yokEPSS %19

    dlink · dsl-2888a firmware8 Oca 2021

  • CVE-2020-35131
    54Planlayın

    Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/M

    KritikCVSS 9,8Kavram kanıtıEPSS %50

    agentejo · cockpit8 Oca 2021

  • CVE-2020-28208
    24İzleyin

    An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.

    OrtaCVSS 5,3Kavram kanıtıEPSS %10

    rocket.chat · rocket.chat8 Oca 2021

  • CVE-2020-16013
    66Bu hafta

    Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %2

    google · chrome8 Oca 2021

  • CVE-2020-16017
    69Bu hafta

    Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %2

    google · chrome8 Oca 2021

  • CVE-2020-16040
    60Bu hafta

    Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption v

    OrtaCVSS 6,5SilahlaştırılmışEPSS %99

    google · chrome8 Oca 2021

  • CVE-2021-3129
    99Hemen

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    laravel · laravel12 Oca 2021

  • CVE-2021-1647
    73Bu hafta

    Microsoft Defender Remote Code Execution Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %39

    microsoft · windows defender12 Oca 2021

  • CVE-2021-1678
    38İzleyin

    Windows Print Spooler Spoofing Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    microsoft · windows 1012 Oca 2021

  • CVE-2021-23124
    48Planlayın

    [20210102] - Core - XSS in mod_breadcrumbs aria-label attribute

    OrtaCVSS 6,1İstismar yokEPSS %78

    joomla · joomla\!12 Oca 2021

  • CVE-2020-35578
    53Planlayın

    An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.

    YüksekCVSS 7,2SilahlaştırılmışEPSS %81

    nagios · nagios xi13 Oca 2021

  • CVE-2020-27265
    42Planlayın

    KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All ver

    KritikCVSS 9,8İstismar yokEPSS %10

    ge · industrial gateway server13 Oca 2021

  • CVE-2021-24122
    30İzleyin

    Apache Tomcat information disclosure

    OrtaCVSS 5,9İstismar yokEPSS %22

    apache · tomcat14 Oca 2021

  • CVE-2020-6572
    68Bu hafta

    Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %10

    google · chrome14 Oca 2021

  • CVE-2020-35749
    39İzleyin

    Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for

    YüksekCVSS 7,7Kavram kanıtıEPSS %30

    presstigers · simple board job15 Oca 2021

  • CVE-2021-21243
    55Planlayın

    Pre-Auth Unsafe Deserialization on KubernetesResource

    KritikCVSS 9,8İstismar yokEPSS %54

    onedev project · onedev15 Oca 2021

  • CVE-2021-21242
    61Bu hafta

    Pre-Auth Unsafe Deserialization on AttachmentUploadServet

    KritikCVSS 9,8İstismar yokEPSS %74

    onedev project · onedev15 Oca 2021

  • CVE-2021-21246
    45Planlayın

    Pre-Auth Access token leak

    YüksekCVSS 7,5Kavram kanıtıEPSS %49

    onedev project · onedev15 Oca 2021

  • CVE-2021-21251
    39İzleyin

    ZipSlip Arbitrary File Upload

    YüksekCVSS 8,8İstismar yokEPSS %12

    onedev project · onedev15 Oca 2021

  • CVE-2021-25294
    42Planlayın

    OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %11

    opencats · opencats18 Oca 2021

  • CVE-2020-36193
    81Hemen

    Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a relat

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %70

    php · archive tar18 Oca 2021

  • CVE-2021-3177
    46Planlayın

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Pyth

    KritikCVSS 9,8İstismar yokEPSS %24

    python · python19 Oca 2021

  • CVE-2020-23342
    39İzleyin

    A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    anchorcms · anchor cms19 Oca 2021

  • CVE-2020-19360
    35İzleyin

    Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    fhem · fhem19 Oca 2021

  • CVE-2020-19364
    56Planlayın

    OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.

    YüksekCVSS 8,8İstismar yokEPSS %70

    open-emr · openemr19 Oca 2021

  • CVE-2020-25385
    29İzleyin

    Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapsh

    OrtaCVSS 6,1İstismar yokEPSS %16

    nagios · log server19 Oca 2021

  • CVE-2021-3110
    45Planlayın

    The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_pro

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    prestashop · prestashop20 Oca 2021

  • CVE-2020-14756
    61Bu hafta

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components).

    KritikCVSS 9,8Kavram kanıtıEPSS %74

    oracle · coherence20 Oca 2021

  • CVE-2021-2021
    22İzleyin

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

    OrtaCVSS 4,9İstismar yokEPSS %10

    oracle · mysql20 Oca 2021

  • CVE-2021-2109
    49Planlayın

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).

    YüksekCVSS 7,2Kavram kanıtıEPSS %70

    oracle · weblogic server20 Oca 2021

  • CVE-2021-2114
    50Planlayın

    Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar).

    YüksekCVSS 8,2İstismar yokEPSS %59

    oracle · common applications calendar20 Oca 2021

  • CVE-2020-25683
    49Planlayın

    A flaw was found in dnsmasq before version 2.83.

    OrtaCVSS 5,9İstismar yokEPSS %86

    thekelleys · dnsmasq20 Oca 2021

  • CVE-2020-25681
    56Planlayın

    A flaw was found in dnsmasq before version 2.83.

    YüksekCVSS 8,1İstismar yokEPSS %81

    thekelleys · dnsmasq20 Oca 2021

  • CVE-2020-25682
    53Planlayın

    A flaw was found in dnsmasq before 2.83.

    YüksekCVSS 8,1İstismar yokEPSS %70

    thekelleys · dnsmasq20 Oca 2021

  • CVE-2020-25687
    49Planlayın

    A flaw was found in dnsmasq before version 2.83.

    OrtaCVSS 5,9İstismar yokEPSS %86

    thekelleys · dnsmasq20 Oca 2021

  • CVE-2020-27858
    52Planlayın

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5.

    YüksekCVSS 7,5İstismar yokEPSS %73

    arcserve · d2d20 Oca 2021

  • CVE-2020-12513
    44Planlayın

    Pepper+Fuchs Comtrol IO-Link Master OS Command Injection

    YüksekCVSS 8,8İstismar yokEPSS %31

    pepperl-fuchs · io-link master 4-eip firmware22 Oca 2021

  • CVE-2020-23826
    39İzleyin

    The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API.

    YüksekCVSS 8,8İstismar yokEPSS %13

    assaabloy · yale wipc-303w firmware26 Oca 2021

  • CVE-2020-35576
    48Planlayın

    A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticate

    YüksekCVSS 8,8Kavram kanıtıEPSS %42

    tp-link · tl-wr841n firmware26 Oca 2021

  • CVE-2021-22873
    45Planlayın

    Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php deli

    OrtaCVSS 6,1Kavram kanıtıEPSS %69

    revive-adserver · revive adserver26 Oca 2021

  • CVE-2021-3223
    36İzleyin

    Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.

    YüksekCVSS 7,5Kavram kanıtıEPSS %18

    nodered · node-red-dashboard26 Oca 2021

  • CVE-2021-3278
    47Planlayın

    Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection .

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    local services search engine management system project · local services search engine management system26 Oca 2021

  • CVE-2021-3291
    33İzleyin

    Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and

    YüksekCVSS 7,2Kavram kanıtıEPSS %16

    zen-cart · zen cart26 Oca 2021

  • CVE-2021-3297
    37İzleyin

    On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.

    YüksekCVSS 7,8Kavram kanıtıEPSS %20

    zyxel · nbg2105 firmware26 Oca 2021

  • CVE-2021-3156
    91Hemen

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %99

    sudo project · sudo26 Oca 2021

  • CVE-2020-36221
    55Planlayın

    An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, result

    YüksekCVSS 7,5İstismar yokEPSS %84

    openldap · openldap26 Oca 2021

  • CVE-2020-36222
    53Planlayın

    A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial

    YüksekCVSS 7,5İstismar yokEPSS %77

    openldap · openldap26 Oca 2021

  • CVE-2020-36227
    53Planlayın

    A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in de

    YüksekCVSS 7,5İstismar yokEPSS %77

    openldap · openldap26 Oca 2021

  • CVE-2020-36228
    55Planlayın

    An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, r

    YüksekCVSS 7,5İstismar yokEPSS %84

    openldap · openldap26 Oca 2021

  • CVE-2020-36230
    34İzleyin

    A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_elemen

    YüksekCVSS 7,5İstismar yokEPSS %12

    openldap · openldap26 Oca 2021

  • CVE-2021-3199
    75Bu hafta

    Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %20

    onlyoffice · document server26 Oca 2021

  • CVE-2021-3317
    47Planlayın

    KLog Server through 2.4.1 allows authenticated command injection.

    YüksekCVSS 8,8Kavram kanıtıEPSS %41

    klogserver · klog server26 Oca 2021

  • CVE-2021-26117
    33İzleyin

    ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

    YüksekCVSS 7,5İstismar yokEPSS %11

    apache · activemq27 Oca 2021

  • CVE-2020-4888
    54Planlayın

    IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system,

    YüksekCVSS 8,8İstismar yokEPSS %61

    ibm · qradar security information and event manager28 Oca 2021

  • CVE-2021-22874
    29İzleyin

    Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.

    OrtaCVSS 6,1İstismar yokEPSS %18

    revive-adserver · revive adserver28 Oca 2021

  • CVE-2021-22875
    29İzleyin

    Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.

    OrtaCVSS 6,1İstismar yokEPSS %18

    revive-adserver · revive adserver28 Oca 2021

  • CVE-2020-35754
    31İzleyin

    OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execut

    YüksekCVSS 7,2Kavram kanıtıEPSS %10

    opensolution · quick.cart28 Oca 2021

  • CVE-2021-3337
    33İzleyin

    The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicki

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    hide thread content project · hide thread content28 Oca 2021

  • CVE-2020-29557
    85Hemen

    An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %54

    dlink · dir-825 r1 firmware29 Oca 2021

  • CVE-2021-25646
    65Bu hafta

    Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %99

    apache · druid29 Oca 2021

  • CVE-2020-15568
    48Planlayın

    TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root.

    KritikCVSS 9,8Kavram kanıtıEPSS %28

    terra-master · tos30 Oca 2021