İçeriğe atla
Noroxi

Yayın tarihine göre

Haziran 2021: sömürülen ve yeni ciddi CVE kayıtları

75 kayıt · 15 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2021-27828
    42Planlayın

    SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content

    KritikCVSS 9,1Kavram kanıtıEPSS %20

    in4velocity · in4suite erp1 Haz 2021

  • CVE-2021-23017
    46Planlayın

    A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cau

    YüksekCVSS 7,7Kavram kanıtıEPSS %53

    f5 · nginx1 Haz 2021

  • CVE-2021-24320
    27İzleyin

    Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    bold-themes · bello1 Haz 2021

  • CVE-2021-24321
    59Planlayın

    Bello < 1.6.0 - Unauthenticated Blind SQL Injection

    KritikCVSS 9,8İstismar yokEPSS %66

    bold-themes · bello1 Haz 2021

  • CVE-2021-25641
    45Planlayın

    Dubbo Zookeeper does not check serialization id

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    apache · dubbo1 Haz 2021

  • CVE-2021-30180
    57Planlayın

    Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)

    KritikCVSS 9,8Kavram kanıtıEPSS %60

    apache · dubbo1 Haz 2021

  • CVE-2021-30181
    57Planlayın

    Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

    KritikCVSS 9,8Kavram kanıtıEPSS %60

    apache · dubbo1 Haz 2021

  • CVE-2021-31642
    39İzleyin

    A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, an

    OrtaCVSS 6,5Kavram kanıtıEPSS %43

    chiyu-tech · semac s2 firmware1 Haz 2021

  • CVE-2021-31643
    48Planlayın

    An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a la

    OrtaCVSS 5,4İstismar yokEPSS %88

    chiyu-tech · bf-631 firmware1 Haz 2021

  • CVE-2021-32924
    41Planlayın

    Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\fr

    YüksekCVSS 8,8İstismar yokEPSS %19

    invisioncommunity · ips community suite1 Haz 2021

  • CVE-2021-22123
    60Bu hafta

    An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a r

    YüksekCVSS 8,8Kavram kanıtıEPSS %84

    fortinet · fortiweb1 Haz 2021

  • CVE-2021-3538
    40Planlayın

    A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7

    KritikCVSS 9,8İstismar yokEPSS %2

    satori · uuid2 Haz 2021

  • CVE-2020-6950
    29İzleyin

    Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

    OrtaCVSS 6,5Kavram kanıtıEPSS %10

    eclipse · mojarra2 Haz 2021

  • CVE-2021-3490
    40Planlayın

    Linux kernel eBPF bitwise ops ALU32 bounds tracking

    YüksekCVSS 7,8SilahlaştırılmışEPSS %27

    linux · linux kernel3 Haz 2021

  • CVE-2021-31249
    31İzleyin

    A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of

    OrtaCVSS 6,5Kavram kanıtıEPSS %18

    chiyu-tech · bf-430 firmware4 Haz 2021

  • CVE-2021-31250
    45Planlayın

    Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to

    OrtaCVSS 5,4Kavram kanıtıEPSS %79

    chiyu-tech · bf-430 firmware4 Haz 2021

  • CVE-2021-31251
    50Planlayın

    An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows o

    KritikCVSS 9,8Kavram kanıtıEPSS %35

    chiyu-tech · bf-430 firmware4 Haz 2021

  • CVE-2021-31252
    33İzleyin

    An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology

    OrtaCVSS 6,1İstismar yokEPSS %28

    chiyu-tech · bf-430 firmware4 Haz 2021

  • CVE-2021-24340
    39İzleyin

    WP Statistics < 13.0.8 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %29

    veronalabs · wp statistics7 Haz 2021

  • CVE-2021-30533
    61Bu hafta

    Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restri

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %16

    google · chrome7 Haz 2021

  • CVE-2021-30538
    22İzleyin

    Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten

    OrtaCVSS 4,3İstismar yokEPSS %15

    google · chrome7 Haz 2021

  • CVE-2021-32671
    52Planlayın

    XSS vulnerability with translator

    KritikCVSS 10,0İstismar yokEPSS %39

    flarum · flarum7 Haz 2021

  • CVE-2021-3277
    44Planlayın

    Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in

    YüksekCVSS 7,2İstismar yokEPSS %54

    nagios · nagios xi7 Haz 2021

  • CVE-2021-30357
    28İzleyin

    SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows p

    OrtaCVSS 5,3Kavram kanıtıEPSS %22

    checkpoint · ssl network extender8 Haz 2021

  • CVE-2021-22214
    42Planlayın

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all ve

    YüksekCVSS 8,6Kavram kanıtıEPSS %27

    gitlab · gitlab8 Haz 2021

  • CVE-2021-31807
    40Planlayın

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %15

    squid-cache · squid8 Haz 2021

  • CVE-2021-1675
    87Hemen

    Windows Print Spooler Remote Code Execution Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %85

    microsoft · windows 10 15078 Haz 2021

  • CVE-2021-26414
    34İzleyin

    Windows DCOM Server Security Feature Bypass

    OrtaCVSS 4,8Kavram kanıtıEPSS %49

    microsoft · windows 108 Haz 2021

  • CVE-2021-31199
    51Planlayın

    Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

    OrtaCVSS 5,2KEVSilahlaştırılmışEPSS %2

    microsoft · windows 10 15078 Haz 2021

  • CVE-2021-31201
    51Planlayın

    Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

    OrtaCVSS 5,2KEVSilahlaştırılmışEPSS %2

    microsoft · windows 10 15078 Haz 2021

  • CVE-2021-31939
    35İzleyin

    Microsoft Excel Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · 365 apps8 Haz 2021

  • CVE-2021-31955
    76Bu hafta

    Windows Kernel Information Disclosure Vulnerability

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %81

    microsoft · windows 10 18098 Haz 2021

  • CVE-2021-31956
    68Bu hafta

    Windows NTFS Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %22

    microsoft · windows 10 15078 Haz 2021

  • CVE-2021-33739
    65Bu hafta

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    YüksekCVSS 8,4KEVSilahlaştırılmışEPSS %6

    microsoft · windows 10 19098 Haz 2021

  • CVE-2021-33742
    78Bu hafta

    Windows MSHTML Platform Remote Code Execution Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %59

    microsoft · windows 10 15078 Haz 2021

  • CVE-2021-28169
    45Planlayın

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to a

    OrtaCVSS 5,3Kavram kanıtıEPSS %78

    eclipse · jetty8 Haz 2021

  • CVE-2020-11261
    61Bu hafta

    Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto,

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    qualcomm · apq8009 firmware9 Haz 2021

  • CVE-2021-33357
    44Planlayın

    A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter va

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    raspap · raspap9 Haz 2021

  • CVE-2021-33393
    53Planlayın

    lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %59

    ipfire · ipfire9 Haz 2021

  • CVE-2019-17567
    39İzleyin

    mod_proxy_wstunnel tunneling of non Upgraded connections

    OrtaCVSS 5,3İstismar yokEPSS %60

    apache · http server10 Haz 2021

  • CVE-2020-13938
    26İzleyin

    Improper Handling of Insufficient Privileges

    OrtaCVSS 5,5İstismar yokEPSS %11

    apache · http server10 Haz 2021

  • CVE-2020-13950
    45Planlayın

    mod_proxy_http NULL pointer dereference

    YüksekCVSS 7,5İstismar yokEPSS %49

    apache · http server10 Haz 2021

  • CVE-2020-35452
    45Planlayın

    mod_auth_digest possible stack overflow by one nul byte

    YüksekCVSS 7,3İstismar yokEPSS %54

    apache · http server10 Haz 2021

  • CVE-2021-26690
    50Planlayın

    mod_session NULL pointer dereference

    YüksekCVSS 7,5Kavram kanıtıEPSS %65

    apache · http server10 Haz 2021

  • CVE-2021-26691
    59Planlayın

    Apache HTTP Server mod_session response handling heap overflow

    KritikCVSS 9,8İstismar yokEPSS %68

    apache · http server10 Haz 2021

  • CVE-2021-30641
    37İzleyin

    Unexpected URL matching with 'MergeSlashes OFF'

    OrtaCVSS 5,3İstismar yokEPSS %52

    apache · http server10 Haz 2021

  • CVE-2021-20081
    44Planlayın

    Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execut

    YüksekCVSS 7,2İstismar yokEPSS %52

    zohocorp · manageengine servicedesk plus10 Haz 2021

  • CVE-2021-26828
    77Bu hafta

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP f

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %39

    scadabr · scadabr11 Haz 2021

  • CVE-2021-26829
    65Bu hafta

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

    OrtaCVSS 5,4KEVSilahlaştırılmışEPSS %48

    scadabr · scadabr11 Haz 2021

  • CVE-2021-25394
    55Planlayın

    A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio

    OrtaCVSS 6,4KEVSilahlaştırılmışEPSS %0

    samsung · android11 Haz 2021

  • CVE-2021-25395
    55Planlayın

    A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privil

    OrtaCVSS 6,4KEVSilahlaştırılmışEPSS %0

    samsung · android11 Haz 2021

  • CVE-2021-22175
    85Hemen

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %53

    gitlab · gitlab11 Haz 2021

  • CVE-2021-22901
    51Planlayın

    curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session t

    YüksekCVSS 8,1İstismar yokEPSS %63

    haxx · curl11 Haz 2021

  • CVE-2021-23394
    45Planlayın

    Remote Code Execution (RCE)

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    std42 · elfinder13 Haz 2021

  • CVE-2021-24347
    51Planlayın

    SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

    YüksekCVSS 8,8SilahlaştırılmışEPSS %54

    smartypantsplugins · sp project \& document manager14 Haz 2021

  • CVE-2021-32682
    60Bu hafta

    Multiple vulnerabilities leading to RCE

    KritikCVSS 9,8SilahlaştırılmışEPSS %69

    std42 · elfinder14 Haz 2021

  • CVE-2021-31618
    45Planlayın

    NULL pointer dereference on specially crafted HTTP/2 request

    YüksekCVSS 7,5İstismar yokEPSS %51

    apache · http server15 Haz 2021

  • CVE-2021-30551
    84Hemen

    Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %64

    google · chrome15 Haz 2021

  • CVE-2021-20093
    46Planlayın

    A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a.

    KritikCVSS 9,1İstismar yokEPSS %33

    wibu · codemeter16 Haz 2021

  • CVE-2021-33813
    36İzleyin

    An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

    YüksekCVSS 7,5İstismar yokEPSS %19

    jdom · jdom16 Haz 2021

  • CVE-2021-31159
    26İzleyin

    Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the

    OrtaCVSS 5,3Kavram kanıtıEPSS %17

    zohocorp · manageengine servicedesk plus msp16 Haz 2021

  • CVE-2021-21667
    44Planlayın

    Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site

    OrtaCVSS 5,4İstismar yokEPSS %75

    jenkins · scriptler16 Haz 2021

  • CVE-2021-21668
    44Planlayın

    Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability expl

    OrtaCVSS 5,4İstismar yokEPSS %76

    jenkins · scriptler16 Haz 2021

  • CVE-2020-22208
    42Planlayın

    SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    74cms · 74cms16 Haz 2021

  • CVE-2021-21669
    47Planlayın

    Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    KritikCVSS 9,8İstismar yokEPSS %25

    jenkins · generic webhook trigger18 Haz 2021

  • CVE-2021-24370
    53Planlayın

    Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE

    KritikCVSS 9,8Kavram kanıtıEPSS %47

    radykal · fancy product designer21 Haz 2021

  • CVE-2021-21998
    42Planlayın

    VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass.

    KritikCVSS 9,8İstismar yokEPSS %10

    vmware · carbon black app control23 Haz 2021

  • CVE-2021-31586
    48Planlayın

    Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.

    YüksekCVSS 8,8İstismar yokEPSS %44

    accellion · kiteworks23 Haz 2021

  • CVE-2021-21809
    43Planlayın

    A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10.

    KritikCVSS 9,1SilahlaştırılmışEPSS %24

    moodle · moodle23 Haz 2021

  • CVE-2021-28958
    61Bu hafta

    Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

    KritikCVSS 9,8İstismar yokEPSS %73

    zohocorp · manageengine adselfservice plus25 Haz 2021

  • CVE-2021-34427
    56Planlayın

    In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curre

    KritikCVSS 9,8Kavram kanıtıEPSS %57

    eclipse · business intelligence and reporting tools25 Haz 2021

  • CVE-2021-34187
    44Planlayın

    main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    chamilo · chamilo28 Haz 2021

  • CVE-2021-35941
    34İzleyin

    Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system f

    YüksekCVSS 7,5İstismar yokEPSS %12

    westerndigital · wd my book live firmware29 Haz 2021

  • CVE-2021-21672
    30İzleyin

    Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    OrtaCVSS 4,3İstismar yokEPSS %42

    jenkins · selenium html report30 Haz 2021

  • CVE-2021-36088
    40Planlayın

    Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).

    KritikCVSS 9,8İstismar yokEPSS %2

    treasuredata · fluent bit30 Haz 2021