İçeriğe atla
Noroxi

Yayın tarihine göre

Şubat 2021: sömürülen ve yeni ciddi CVE kayıtları

152 kayıt · 19 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2021-25297
    82Hemen

    Nagios XI version xi-5.7.5 is affected by OS command injection.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %56

    nagios · nagios xi15 Şub 2021

  • CVE-2021-25298
    87Hemen

    Nagios XI version xi-5.7.5 is affected by OS command injection.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %73

    nagios · nagios xi15 Şub 2021

  • CVE-2021-25299
    53Planlayın

    Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).

    OrtaCVSS 6,1Kavram kanıtıEPSS %97

    nagios · nagios xi15 Şub 2021

  • CVE-2020-35775
    43Planlayın

    CITSmart before 9.1.2.23 allows LDAP Injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    citsmart · citsmart15 Şub 2021

  • CVE-2021-23336
    35İzleyin

    The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2

    OrtaCVSS 5,9İstismar yokEPSS %40

    python · python15 Şub 2021

  • CVE-2021-23337
    34İzleyin

    Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

    YüksekCVSS 7,2Kavram kanıtıEPSS %21

    lodash · lodash15 Şub 2021

  • CVE-2020-22427
    32İzleyin

    NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability.

    YüksekCVSS 7,2İstismar yokEPSS %14

    nagios · nagios xi15 Şub 2021

  • CVE-2020-24899
    40Planlayın

    Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability.

    YüksekCVSS 8,8İstismar yokEPSS %16

    nagios · nagios xi15 Şub 2021

  • CVE-2020-28337
    33İzleyin

    A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code exec

    YüksekCVSS 7,2Kavram kanıtıEPSS %16

    microweber · microweber15 Şub 2021

  • CVE-2021-3239
    45Planlayın

    E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code o

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    e-learning system project · e-learning system15 Şub 2021

  • CVE-2021-21315
    88Hemen

    Command Injection Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %90

    systeminformation · systeminformation16 Şub 2021

  • CVE-2021-23840
    45Planlayın

    Integer overflow in CipherUpdate

    YüksekCVSS 7,5Kavram kanıtıEPSS %50

    openssl · openssl16 Şub 2021

  • CVE-2021-27101
    71Bu hafta

    Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %5

    accellion · fta16 Şub 2021

  • CVE-2021-27102
    62Bu hafta

    Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    accellion · fta16 Şub 2021

  • CVE-2021-27103
    72Bu hafta

    Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %11

    accellion · fta16 Şub 2021

  • CVE-2021-27104
    86Hemen

    Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %56

    accellion · fta16 Şub 2021

  • CVE-2021-27224
    41Planlayın

    The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x0000000000012ec6, which might allo

    YüksekCVSS 7,5İstismar yokEPSS %37

    irfanview · wpg17 Şub 2021

  • CVE-2020-8625
    51Planlayın

    A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

    YüksekCVSS 8,1İstismar yokEPSS %64

    isc · bind17 Şub 2021

  • CVE-2020-28463
    26İzleyin

    Server-side Request Forgery (SSRF)

    OrtaCVSS 6,5İstismar yokEPSS %1

    reportlab · reportlab18 Şub 2021

  • CVE-2021-26747
    55Planlayın

    Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execut

    KritikCVSS 9,8İstismar yokEPSS %54

    netis-systems · wf2780 firmware18 Şub 2021

  • CVE-2019-25024
    47Planlayın

    OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_servic

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    alleghenycreative · openrepeater19 Şub 2021

  • CVE-2021-27513
    44Planlayın

    The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le

    YüksekCVSS 8,8Kavram kanıtıEPSS %28

    eyesofnetwork · eyesofnetwork21 Şub 2021

  • CVE-2021-26120
    64Bu hafta

    Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.

    KritikCVSS 9,8İstismar yokEPSS %82

    smarty · smarty21 Şub 2021

  • CVE-2020-21224
    51Planlayın

    A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0.

    KritikCVSS 9,8Kavram kanıtıEPSS %38

    inspur · clusterengine22 Şub 2021

  • CVE-2021-3120
    50Planlayın

    An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers

    KritikCVSS 9,8İstismar yokEPSS %36

    yithemes · yith woocommerce gift cards22 Şub 2021

  • CVE-2020-29453
    27İzleyin

    The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8

    OrtaCVSS 5,3Kavram kanıtıEPSS %20

    atlassian · data center22 Şub 2021

  • CVE-2020-28429
    58Planlayın

    All versions of package geojson2kml are vulnerable to Command Injection via the index.js file.

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    geojson2kml project · geojson2kml23 Şub 2021

  • CVE-2020-16243
    35İzleyin

    Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files.

    YüksekCVSS 7,8İstismar yokEPSS %12

    we-con · levistudiou23 Şub 2021

  • CVE-2021-3407
    37İzleyin

    A flaw was found in mupdf 1.18.0.

    OrtaCVSS 5,5İstismar yokEPSS %50

    artifex · mupdf23 Şub 2021

  • CVE-2021-20660
    38İzleyin

    Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via u

    OrtaCVSS 6,1İstismar yokEPSS %47

    contec · sv-cpt-mc310 firmware24 Şub 2021

  • CVE-2021-21616
    41Planlayın

    Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS)

    OrtaCVSS 4,6İstismar yokEPSS %76

    jenkins · active choices24 Şub 2021

  • CVE-2021-21618
    45Planlayın

    Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a store

    OrtaCVSS 5,4İstismar yokEPSS %79

    jenkins · repository connector24 Şub 2021

  • CVE-2021-21972
    99Hemen

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    vmware · cloud foundation24 Şub 2021

  • CVE-2021-21973
    77Bu hafta

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Serv

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %88

    vmware · cloud foundation24 Şub 2021

  • CVE-2021-21974
    49Planlayın

    OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflo

    YüksekCVSS 8,8Kavram kanıtıEPSS %45

    vmware · cloud foundation24 Şub 2021

  • CVE-2021-1388
    44Planlayın

    Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability

    KritikCVSS 10,0İstismar yokEPSS %14

    cisco · aci multi-site orchestrator24 Şub 2021

  • CVE-2020-11987
    36İzleyin

    Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel.

    YüksekCVSS 8,2İstismar yokEPSS %13

    apache · batik24 Şub 2021

  • CVE-2021-27670
    57Planlayın

    Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %61

    appspace · appspace24 Şub 2021

  • CVE-2021-1732
    85Hemen

    Windows Win32k Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %78

    microsoft · windows 10 180325 Şub 2021

  • CVE-2021-24074
    47Planlayın

    Windows TCP/IP Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %26

    microsoft · windows 1025 Şub 2021

  • CVE-2021-24078
    43Planlayın

    Windows DNS Server Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %11

    microsoft · windows server 200825 Şub 2021

  • CVE-2021-24086
    48Planlayın

    Windows TCP/IP Denial of Service Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %58

    microsoft · windows 1025 Şub 2021

  • CVE-2021-24093
    49Planlayın

    Windows Graphics Component Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %46

    microsoft · windows 1025 Şub 2021

  • CVE-2021-24094
    46Planlayın

    Windows TCP/IP Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %22

    microsoft · windows 1025 Şub 2021

  • CVE-2021-26701
    41Planlayın

    .NET Core Remote Code Execution Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %30

    microsoft · .net25 Şub 2021

  • CVE-2020-27223
    44Planlayın

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept

    OrtaCVSS 5,3Kavram kanıtıEPSS %78

    eclipse · jetty26 Şub 2021

  • CVE-2021-27198
    43Planlayın

    An issue was discovered in Visualware MyConnection Server before v11.1a.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    visualware · myconnection server26 Şub 2021

  • CVE-2021-25281
    61Bu hafta

    An issue was discovered in through SaltStack Salt before 3002.5.

    KritikCVSS 9,8SilahlaştırılmışEPSS %73

    saltstack · salt27 Şub 2021

  • CVE-2021-25282
    64Bu hafta

    An issue was discovered in through SaltStack Salt before 3002.5.

    KritikCVSS 9,1SilahlaştırılmışEPSS %92

    saltstack · salt27 Şub 2021

  • CVE-2021-25283
    42Planlayın

    An issue was discovered in through SaltStack Salt before 3002.5.

    KritikCVSS 9,8İstismar yokEPSS %10

    saltstack · salt27 Şub 2021

  • CVE-2021-3197
    61Bu hafta

    An issue was discovered in SaltStack Salt before 3002.5.

    KritikCVSS 9,8İstismar yokEPSS %71

    saltstack · salt27 Şub 2021

  • CVE-2021-27132
    44Planlayın

    SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposi

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    sercomm · agcombo vd625 firmware27 Şub 2021