İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2021: sömürülen ve yeni ciddi CVE kayıtları

76 kayıt · 16 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2021-31813
    44Planlayın

    Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user

    OrtaCVSS 5,4İstismar yokEPSS %78

    zohocorp · manageengine applications manager1 Tem 2021

  • CVE-2021-35336
    42Planlayın

    Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control.

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    tieline · ip audtio gateway firmware1 Tem 2021

  • CVE-2021-35042
    52Planlayın

    Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w

    KritikCVSS 9,8Kavram kanıtıEPSS %44

    djangoproject · django2 Tem 2021

  • CVE-2021-30554
    67Bu hafta

    Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craft

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %7

    google · chrome2 Tem 2021

  • CVE-2021-30557
    39İzleyin

    Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extensio

    YüksekCVSS 8,8İstismar yokEPSS %11

    google · chrome2 Tem 2021

  • CVE-2021-34527
    95Hemen

    Windows Print Spooler Remote Code Execution Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    microsoft · windows 10 15072 Tem 2021

  • CVE-2021-24405
    29İzleyin

    Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting

    OrtaCVSS 6,5Kavram kanıtıEPSS %10

    izsoft · easy cookies policy6 Tem 2021

  • CVE-2021-34621
    60Bu hafta

    ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

    KritikCVSS 9,8Kavram kanıtıEPSS %68

    properfraction · profilepress7 Tem 2021

  • CVE-2020-24148
    40Planlayın

    Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a

    KritikCVSS 9,1Kavram kanıtıEPSS %14

    mooveagency · import xml and rss feeds7 Tem 2021

  • CVE-2021-33216
    43Planlayın

    An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    commscope · ruckus iot controller7 Tem 2021

  • CVE-2021-33221
    56Planlayın

    An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    commscope · ruckus iot controller7 Tem 2021

  • CVE-2021-22555
    85Hemen

    Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %78

    linux · linux kernel7 Tem 2021

  • CVE-2021-28809
    44Planlayın

    Missing Authentication for Critical Function in RTRR Server in HBS3

    KritikCVSS 9,8İstismar yokEPSS %16

    qnap · hybrid backup sync8 Tem 2021

  • CVE-2021-1585
    38İzleyin

    Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability

    YüksekCVSS 8,1Kavram kanıtıEPSS %19

    cisco · adaptive security device manager8 Tem 2021

  • CVE-2021-30116
    95Hemen

    Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %85

    kaseya · vsa agent9 Tem 2021

  • CVE-2021-30117
    57Planlayın

    Authenticated SQL injection in Kaseya VSA < v9.5.6

    YüksekCVSS 8,8İstismar yokEPSS %72

    kaseya · vsa9 Tem 2021

  • CVE-2021-30118
    57Planlayın

    Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5

    KritikCVSS 9,8Kavram kanıtıEPSS %60

    kaseya · vsa9 Tem 2021

  • CVE-2021-30119
    39İzleyin

    Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6

    OrtaCVSS 5,4İstismar yokEPSS %58

    kaseya · vsa9 Tem 2021

  • CVE-2021-30201
    38İzleyin

    Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6

    YüksekCVSS 7,5İstismar yokEPSS %26

    kaseya · vsa9 Tem 2021

  • CVE-2021-22918
    28İzleyin

    Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII.

    OrtaCVSS 5,3İstismar yokEPSS %23

    nodejs · node.js12 Tem 2021

  • CVE-2021-35064
    60Bu hafta

    KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo.

    KritikCVSS 9,8Kavram kanıtıEPSS %70

    kramerav · viaware12 Tem 2021

  • CVE-2021-33807
    35İzleyin

    Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    gespage · gespage12 Tem 2021

  • CVE-2021-33037
    43Planlayın

    Incorrect Transfer-Encoding handling with HTTP/1.0

    OrtaCVSS 5,3İstismar yokEPSS %74

    apache · tomcat12 Tem 2021

  • CVE-2021-24442
    53Planlayın

    Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %45

    wpdevart · poll\, survey\, questionnaire and voting system12 Tem 2021

  • CVE-2021-35515
    33İzleyin

    Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %11

    apache · commons compress13 Tem 2021

  • CVE-2021-35516
    34İzleyin

    Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %12

    apache · commons compress13 Tem 2021

  • CVE-2021-35517
    33İzleyin

    Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %10

    apache · commons compress13 Tem 2021

  • CVE-2021-36090
    34İzleyin

    Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %12

    apache · commons compress13 Tem 2021

  • CVE-2021-31196
    74Bu hafta

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %54

    microsoft · exchange server14 Tem 2021

  • CVE-2021-31206
    34İzleyin

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 7,6Kavram kanıtıEPSS %13

    microsoft · exchange server14 Tem 2021

  • CVE-2021-31979
    62Bu hafta

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %4

    microsoft · windows 10 150714 Tem 2021

  • CVE-2021-33766
    88Hemen

    Microsoft Exchange Server Information Disclosure Vulnerability

    YüksekCVSS 7,3KEVSilahlaştırılmışEPSS %98

    microsoft · exchange server14 Tem 2021

  • CVE-2021-33771
    64Bu hafta

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %10

    microsoft · windows 10 150714 Tem 2021

  • CVE-2021-34473
    96Hemen

    Microsoft Exchange Server Remote Code Execution Vulnerability

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %99

    microsoft · exchange server14 Tem 2021

  • CVE-2021-34501
    47Planlayın

    Microsoft Excel Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %51

    microsoft · 365 apps14 Tem 2021

  • CVE-2021-34523
    96Hemen

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    KritikCVSS 9,0KEVSilahlaştırılmışEPSS %99

    microsoft · exchange server14 Tem 2021

  • CVE-2021-35211
    97Hemen

    Serv-U Remote Memory Escape Vulnerability

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %91

    solarwinds · serv-u14 Tem 2021

  • CVE-2020-25736
    40Planlayın

    Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configurati

    YüksekCVSS 7,8SilahlaştırılmışEPSS %2

    acronis · true image15 Tem 2021

  • CVE-2021-34429
    60Bu hafta

    For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con

    OrtaCVSS 5,3SilahlaştırılmışEPSS %99

    eclipse · jetty15 Tem 2021

  • CVE-2021-21799
    28İzleyin

    Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

    OrtaCVSS 6,1Kavram kanıtıEPSS %12

    advantech · r-seenet16 Tem 2021

  • CVE-2021-21800
    28İzleyin

    Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

    OrtaCVSS 6,1Kavram kanıtıEPSS %14

    advantech · r-seenet16 Tem 2021

  • CVE-2021-21801
    43Planlayın

    This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.

    OrtaCVSS 6,1Kavram kanıtıEPSS %63

    advantech · r-seenet16 Tem 2021

  • CVE-2021-21816
    27İzleyin

    An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03.

    OrtaCVSS 4,3Kavram kanıtıEPSS %32

    dlink · dir-3040 firmware16 Tem 2021

  • CVE-2021-28114
    37İzleyin

    Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

    OrtaCVSS 5,4İstismar yokEPSS %52

    froala · froala editor16 Tem 2021

  • CVE-2021-34448
    69Bu hafta

    Scripting Engine Memory Corruption Vulnerability

    OrtaCVSS 6,8KEVSilahlaştırılmışEPSS %40

    microsoft · windows 10 150716 Tem 2021

  • CVE-2021-34481
    49Planlayın

    Windows Print Spooler Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %47

    microsoft · windows 1016 Tem 2021

  • CVE-2021-35449
    40Planlayın

    The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1

    YüksekCVSS 7,8SilahlaştırılmışEPSS %1

    lexmark · g2 driver19 Tem 2021

  • CVE-2021-2456
    63Bu hafta

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).

    KritikCVSS 9,8Kavram kanıtıEPSS %81

    oracle · business intelligence20 Tem 2021

  • CVE-2021-22145
    49Planlayın

    A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting.

    OrtaCVSS 6,5SilahlaştırılmışEPSS %76

    elastic · elasticsearch21 Tem 2021

  • CVE-2021-22146
    41Planlayın

    All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.

    YüksekCVSS 7,5Kavram kanıtıEPSS %35

    elastic · elasticsearch21 Tem 2021

  • CVE-2021-22707
    58Planlayın

    A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlin

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    schneider-electric · evlink city evc1s22p4 firmware21 Tem 2021

  • CVE-2021-22784
    26İzleyin

    A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker

    OrtaCVSS 5,7İstismar yokEPSS %12

    schneider-electric · c-bus toolkit21 Tem 2021

  • CVE-2021-2391
    45Planlayın

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Scheduler).

    YüksekCVSS 8,8İstismar yokEPSS %34

    oracle · bi publisher21 Tem 2021

  • CVE-2021-2394
    62Bu hafta

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    KritikCVSS 9,8Kavram kanıtıEPSS %76

    oracle · weblogic server21 Tem 2021

  • CVE-2021-2396
    46Planlayın

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

    YüksekCVSS 8,8İstismar yokEPSS %35

    oracle · bi publisher21 Tem 2021

  • CVE-2021-2400
    55Planlayın

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

    YüksekCVSS 7,5İstismar yokEPSS %83

    oracle · bi publisher21 Tem 2021

  • CVE-2021-2401
    46Planlayın

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

    OrtaCVSS 5,3İstismar yokEPSS %84

    oracle · bi publisher21 Tem 2021

  • CVE-2021-2429
    35İzleyin

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

    OrtaCVSS 5,9İstismar yokEPSS %41

    oracle · mysql server21 Tem 2021

  • CVE-2021-32761
    39İzleyin

    Integer overflow issues with *BIT commands on 32-bit systems

    YüksekCVSS 7,5İstismar yokEPSS %30

    redislabs · redis21 Tem 2021

  • CVE-2021-36934
    81Hemen

    Windows Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %67

    microsoft · windows 10 180922 Tem 2021

  • CVE-2015-2098
    39İzleyin

    Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to th

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    webgateinc · edvr manager22 Tem 2021

  • CVE-2015-2099
    39İzleyin

    Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetR

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    webgateinc · control center22 Tem 2021

  • CVE-2021-33032
    56Planlayın

    A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 an

    KritikCVSS 10,0İstismar yokEPSS %52

    eq-3 · homematic ccu2 firmware22 Tem 2021

  • CVE-2021-35464
    99Hemen

    ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    forgerock · access management22 Tem 2021

  • CVE-2020-7387
    60Bu hafta

    Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor

    OrtaCVSS 5,3SilahlaştırılmışEPSS %34

    sage · adxadmin22 Tem 2021

  • CVE-2020-7388
    60Bu hafta

    Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing

    KritikCVSS 9,8SilahlaştırılmışEPSS %69

    sage · adxadmin22 Tem 2021

  • CVE-2021-36222
    33İzleyin

    ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 a

    YüksekCVSS 7,5İstismar yokEPSS %10

    mit · kerberos 522 Tem 2021

  • CVE-2021-32789
    35İzleyin

    Arbitrary SQL (SQL injection) possible via the Store API component.

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    automattic · woocommerce blocks26 Tem 2021

  • CVE-2020-36239
    54Planlayın

    Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 b

    KritikCVSS 9,8İstismar yokEPSS %49

    atlassian · jira data center29 Tem 2021

  • CVE-2021-36741
    66Bu hafta

    An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 1

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %4

    trendmicro · officescan29 Tem 2021

  • CVE-2021-36742
    61Bu hafta

    A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    trendmicro · officescan29 Tem 2021

  • CVE-2021-28966
    47Planlayın

    In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.

    YüksekCVSS 7,5İstismar yokEPSS %58

    ruby-lang · ruby30 Tem 2021

  • CVE-2021-32610
    50Planlayın

    In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

    YüksekCVSS 7,1İstismar yokEPSS %73

    php · archive tar30 Tem 2021

  • CVE-2021-35478
    44Planlayın

    Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.

    OrtaCVSS 5,4İstismar yokEPSS %76

    nagios · log server30 Tem 2021

  • CVE-2021-35479
    25İzleyin

    Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affect

    OrtaCVSS 5,4İstismar yokEPSS %13

    nagios · log server30 Tem 2021

  • CVE-2021-36754
    49Planlayın

    PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a

    YüksekCVSS 7,5Kavram kanıtıEPSS %64

    powerdns · authoritative server30 Tem 2021