İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2021: sömürülen ve yeni ciddi CVE kayıtları

87 kayıt · 19 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2021-28359
    28İzleyin

    Apache Airflow Reflected XSS via Origin Query Argument in URL

    OrtaCVSS 6,1İstismar yokEPSS %14

    apache · airflow2 May 2021

  • CVE-2021-21551
    85Hemen

    Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of servi

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %80

    dell · dbutil4 May 2021

  • CVE-2021-31800
    45Planlayın

    Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22.

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    secureauth · impacket5 May 2021

  • CVE-2021-24274
    29İzleyin

    Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %17

    supsystic · ultimate maps5 May 2021

  • CVE-2021-24275
    29İzleyin

    Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %18

    supsystic · popup5 May 2021

  • CVE-2021-24276
    29İzleyin

    Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %16

    supsystic · contact form5 May 2021

  • CVE-2020-28017
    50Planlayın

    Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients

    KritikCVSS 9,8İstismar yokEPSS %36

    exim · exim6 May 2021

  • CVE-2020-28018
    56Planlayın

    Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    exim · exim6 May 2021

  • CVE-2020-28019
    48Planlayın

    Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.

    YüksekCVSS 7,5İstismar yokEPSS %61

    exim · exim6 May 2021

  • CVE-2021-1497
    99Hemen

    Cisco HyperFlex HX Command Injection Vulnerabilities

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    cisco · hyperflex hx data platform6 May 2021

  • CVE-2021-1498
    99Hemen

    Cisco HyperFlex HX Command Injection Vulnerabilities

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    cisco · hyperflex hx data platform6 May 2021

  • CVE-2021-1499
    60Bu hafta

    Cisco HyperFlex HX Data Platform File Upload Vulnerability

    OrtaCVSS 5,3SilahlaştırılmışEPSS %80

    cisco · hyperflex hx data platform6 May 2021

  • CVE-2021-29490
    44Planlayın

    Unauthenticated GET requests through Remote Image endpoints

    OrtaCVSS 5,8Kavram kanıtıEPSS %69

    jellyfin · jellyfin6 May 2021

  • CVE-2021-32030
    99Hemen

    The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatio

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    asus · lyra mini firmware6 May 2021

  • CVE-2021-28149
    31İzleyin

    Hongdian H8922 3.0.5 devices allow Directory Traversal.

    OrtaCVSS 6,5Kavram kanıtıEPSS %15

    hongdian · h8922 firmware6 May 2021

  • CVE-2021-28151
    43Planlayın

    Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cg

    YüksekCVSS 8,8Kavram kanıtıEPSS %27

    hongdian · h8922 firmware6 May 2021

  • CVE-2021-29203
    59Planlayın

    A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Managemen

    KritikCVSS 9,8Kavram kanıtıEPSS %68

    hp · edgeline infrastructure manager6 May 2021

  • CVE-2021-32099
    43Planlayın

    A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    artica · pandora fms7 May 2021

  • CVE-2021-1905
    61Bu hafta

    Possible use after free due to improper handling of memory mapping of multiple processes simultaneously.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    qualcomm · apq8009 firmware7 May 2021

  • CVE-2021-1906
    52Planlayın

    Improper handling of address deregistration on failure can lead to new GPU address allocation failure.

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %0

    qualcomm · apq8009 firmware7 May 2021

  • CVE-2021-31755
    95Hemen

    An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %86

    tenda · ac11 firmware7 May 2021

  • CVE-2021-28663
    69Bu hafta

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading t

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %12

    arm · bifrost gpu kernel driver10 May 2021

  • CVE-2021-28664
    67Bu hafta

    The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achie

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %5

    arm · bifrost gpu kernel driver10 May 2021

  • CVE-2020-23575
    41Planlayın

    A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus.

    YüksekCVSS 7,5Kavram kanıtıEPSS %37

    kyocera · d-copia253mf plus firmware10 May 2021

  • CVE-2021-21648
    27İzleyin

    Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cr

    OrtaCVSS 6,1İstismar yokEPSS %11

    jenkins · credentials11 May 2021

  • CVE-2021-21649
    43Planlayın

    Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site

    OrtaCVSS 5,4İstismar yokEPSS %72

    jenkins · dashboard view11 May 2021

  • CVE-2021-26419
    37İzleyin

    Scripting Engine Memory Corruption Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %22

    microsoft · internet explorer11 May 2021

  • CVE-2021-27068
    51Planlayın

    Visual Studio Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %53

    microsoft · visual studio 201911 May 2021

  • CVE-2021-28474
    50Planlayın

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %50

    microsoft · sharepoint foundation11 May 2021

  • CVE-2021-28476
    51Planlayın

    Windows Hyper-V Remote Code Execution Vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %39

    microsoft · windows 1011 May 2021

  • CVE-2021-31166
    99Hemen

    HTTP Protocol Stack Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    microsoft · windows 10 200411 May 2021

  • CVE-2021-31178
    27İzleyin

    Microsoft Office Information Disclosure Vulnerability

    OrtaCVSS 5,5İstismar yokEPSS %16

    microsoft · 365 apps11 May 2021

  • CVE-2021-31179
    35İzleyin

    Microsoft Office Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · 365 apps11 May 2021

  • CVE-2021-31181
    44Planlayın

    Microsoft SharePoint Remote Code Execution Vulnerability

    YüksekCVSS 8,8SilahlaştırılmışEPSS %29

    microsoft · sharepoint enterprise server11 May 2021

  • CVE-2021-31195
    48Planlayın

    Microsoft Exchange Server Remote Code Execution Vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %73

    microsoft · exchange server11 May 2021

  • CVE-2021-31207
    86Hemen

    Microsoft Exchange Server Security Feature Bypass Vulnerability

    OrtaCVSS 6,6KEVSilahlaştırılmışEPSS %99

    microsoft · exchange server11 May 2021

  • CVE-2021-31213
    47Planlayın

    Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %52

    microsoft · remote11 May 2021

  • CVE-2020-36289
    51Planlayın

    Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu

    OrtaCVSS 5,3Kavram kanıtıEPSS %99

    atlassian · data center12 May 2021

  • CVE-2021-32607
    49Planlayın

    An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1.

    KritikCVSS 9,8İstismar yokEPSS %33

    smartstore · smartstore12 May 2021

  • CVE-2021-32608
    49Planlayın

    An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1.

    KritikCVSS 9,8İstismar yokEPSS %33

    smartstore · smartstore12 May 2021

  • CVE-2021-30214
    28İzleyin

    Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' paramet

    OrtaCVSS 5,4İstismar yokEPSS %23

    eng · knowage12 May 2021

  • CVE-2020-36197
    41Planlayın

    Improper Access Control Vulnerability in Music Station

    YüksekCVSS 8,8İstismar yokEPSS %18

    qnap · music station12 May 2021

  • CVE-2021-28799
    92Hemen

    Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %78

    qnap · hybrid backup sync12 May 2021

  • CVE-2021-24284
    52Planlayın

    Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %42

    kaswara project · kaswara14 May 2021

  • CVE-2021-24285
    43Planlayın

    Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    cars-seller-auto-classifieds-script project · cars-seller-auto-classifieds-script14 May 2021

  • CVE-2021-24286
    28İzleyin

    Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %12

    mooveagency · redirect 404 to parent14 May 2021

  • CVE-2021-24287
    27İzleyin

    Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    mooveagency · select all categories and taxonomies\, change checkbox to radio buttons14 May 2021

  • CVE-2021-24291
    28İzleyin

    Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %14

    10web · photo gallery14 May 2021

  • CVE-2021-32819
    52Planlayın

    Remote code execution in squirrelly

    YüksekCVSS 8,8Kavram kanıtıEPSS %58

    squirrelly · squirrelly14 May 2021

  • CVE-2021-32820
    39İzleyin

    File disclosure in Express Handlebars

    YüksekCVSS 8,6Kavram kanıtıEPSS %15

    express handlebars project · express handlebars14 May 2021

  • CVE-2021-3518
    42Planlayın

    There's a flaw in libxml2 in versions before 2.9.11.

    YüksekCVSS 8,8İstismar yokEPSS %21

    xmlsoft · libxml218 May 2021

  • CVE-2021-32305
    65Bu hafta

    WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %87

    websvn · websvn18 May 2021

  • CVE-2021-31316
    43Planlayın

    The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    control-webpanel · webpanel18 May 2021

  • CVE-2021-31324
    49Planlayın

    The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    control-webpanel · webpanel18 May 2021

  • CVE-2021-3517
    39İzleyin

    There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.

    YüksekCVSS 8,6İstismar yokEPSS %16

    xmlsoft · libxml219 May 2021

  • CVE-2021-29622
    30İzleyin

    Arbitrary redirects under /new endpoint

    OrtaCVSS 6,1Kavram kanıtıEPSS %19

    prometheus · prometheus19 May 2021

  • CVE-2020-35580
    34İzleyin

    A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrar

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    searchblox · searchblox20 May 2021

  • CVE-2021-31474
    67Bu hafta

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 202

    KritikCVSS 9,8İstismar yokEPSS %93

    solarwinds · network performance monitor21 May 2021

  • CVE-2021-1531
    44Planlayın

    Cisco Modeling Labs Web UI Command Injection Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %30

    cisco · modeling labs22 May 2021

  • CVE-2021-24300
    27İzleyin

    PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    pickplugins · product slider for woocommerce24 May 2021

  • CVE-2021-24307
    51Planlayın

    All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize

    YüksekCVSS 8,8Kavram kanıtıEPSS %53

    aioseo · all in one seo24 May 2021

  • CVE-2020-28901
    43Planlayın

    Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrup

    KritikCVSS 9,8İstismar yokEPSS %11

    nagios · fusion24 May 2021

  • CVE-2020-28903
    28İzleyin

    Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary H

    OrtaCVSS 6,1İstismar yokEPSS %13

    nagios · fusion24 May 2021

  • CVE-2020-28905
    43Planlayın

    Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.

    YüksekCVSS 8,8İstismar yokEPSS %26

    nagios · fusion24 May 2021

  • CVE-2021-29256
    66Bu hafta

    .

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %2

    arm · bifrost gpu kernel driver24 May 2021

  • CVE-2021-21659
    52Planlayın

    Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    YüksekCVSS 8,1İstismar yokEPSS %66

    jenkins · urltrigger25 May 2021

  • CVE-2021-27562
    53Planlayın

    In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure da

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %3

    trustedfirmware · trusted firmware-m25 May 2021

  • CVE-2021-22160
    55Planlayın

    Authentication with JWT allows use of “none”-algorithm

    KritikCVSS 9,8İstismar yokEPSS %52

    apache · pulsar26 May 2021

  • CVE-2021-21985
    99Hemen

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check pl

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    vmware · vcenter server26 May 2021

  • CVE-2021-21986
    43Planlayın

    The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, v

    KritikCVSS 9,8İstismar yokEPSS %13

    vmware · vcenter server26 May 2021

  • CVE-2021-33558
    34İzleyin

    Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, l

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    boa · boa27 May 2021

  • CVE-2021-22894
    77Bu hafta

    A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary c

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %41

    ivanti · connect secure27 May 2021

  • CVE-2021-22899
    72Bu hafta

    A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote co

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %22

    ivanti · connect secure27 May 2021

  • CVE-2021-22900
    62Bu hafta

    A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administra

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %14

    ivanti · connect secure27 May 2021

  • CVE-2021-22908
    56Planlayın

    A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse

    YüksekCVSS 8,8İstismar yokEPSS %69

    ivanti · connect secure27 May 2021

  • CVE-2021-22911
    68Bu hafta

    A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injectio

    KritikCVSS 9,8Kavram kanıtıEPSS %95

    rocket.chat · rocket.chat27 May 2021

  • CVE-2021-28662
    48Planlayın

    An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6.

    OrtaCVSS 6,5İstismar yokEPSS %71

    squid-cache · squid27 May 2021

  • CVE-2021-30465
    37İzleyin

    runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal.

    YüksekCVSS 8,5İstismar yokEPSS %10

    linuxfoundation · runc27 May 2021

  • CVE-2021-31535
    42Planlayın

    LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code.

    KritikCVSS 9,8İstismar yokEPSS %10

    x.org · libx1127 May 2021

  • CVE-2021-31806
    55Planlayın

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %95

    squid-cache · squid27 May 2021

  • CVE-2021-20026
    38İzleyin

    A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP r

    YüksekCVSS 8,8İstismar yokEPSS %11

    sonicwall · network security manager27 May 2021

  • CVE-2021-27852
    78Bu hafta

    Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute a

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %30

    checkbox · survey27 May 2021

  • CVE-2021-33620
    50Planlayın

    Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTT

    OrtaCVSS 6,5İstismar yokEPSS %79

    squid-cache · squid28 May 2021

  • CVE-2021-29492
    53Planlayın

    Bypass of path matching rules using escaped slash characters

    YüksekCVSS 8,3İstismar yokEPSS %66

    envoyproxy · envoy28 May 2021

  • CVE-2021-29505
    58Planlayın

    XStream is vulnerable to a Remote Command Execution attack

    YüksekCVSS 8,8Kavram kanıtıEPSS %77

    xstream · xstream28 May 2021

  • CVE-2021-30461
    50Planlayın

    A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61.

    KritikCVSS 9,8Kavram kanıtıEPSS %36

    voipmonitor · voipmonitor29 May 2021

  • CVE-2021-33564
    61Bu hafta

    An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files

    KritikCVSS 9,8Kavram kanıtıEPSS %72

    dragonfly project · dragonfly29 May 2021