İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2021: sömürülen ve yeni ciddi CVE kayıtları

89 kayıt · 18 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2021-41648
    33İzleyin

    An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter.

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    online-shopping-system-advanced project · online-shopping-system-advanced1 Eki 2021

  • CVE-2021-41649
    55Planlayın

    An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %51

    online-shopping-system-advanced project · online-shopping-system-advanced1 Eki 2021

  • CVE-2021-40323
    65Bu hafta

    Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template i

    KritikCVSS 9,8Kavram kanıtıEPSS %86

    cobbler project · cobbler4 Eki 2021

  • CVE-2021-40324
    51Planlayın

    Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

    YüksekCVSS 7,5İstismar yokEPSS %68

    cobbler project · cobbler4 Eki 2021

  • CVE-2021-32626
    40Planlayın

    Lua scripts can overflow the heap-based Lua stack in Redis

    YüksekCVSS 8,8İstismar yokEPSS %16

    redis · redis4 Eki 2021

  • CVE-2021-32628
    34İzleyin

    Vulnerability in handling large ziplists

    YüksekCVSS 7,5İstismar yokEPSS %13

    redis · redis4 Eki 2021

  • CVE-2021-32675
    35İzleyin

    DoS vulnerability in Redis

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    redis · redis4 Eki 2021

  • CVE-2021-32687
    31İzleyin

    Integer overflow issue with intsets in Redis

    YüksekCVSS 7,5İstismar yokEPSS %4

    redis · redis4 Eki 2021

  • CVE-2021-41578
    34İzleyin

    mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files.

    YüksekCVSS 7,8İstismar yokEPSS %10

    myscada · mydesigner4 Eki 2021

  • CVE-2021-41524
    38İzleyin

    null pointer dereference in h2 fuzzing

    YüksekCVSS 7,5İstismar yokEPSS %25

    apache · http server5 Eki 2021

  • CVE-2021-41773
    99Hemen

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    apache · http server5 Eki 2021

  • CVE-2021-39226
    89Hemen

    Snapshot authentication bypass in grafana

    YüksekCVSS 7,3KEVSilahlaştırılmışEPSS %99

    grafana · grafana5 Eki 2021

  • CVE-2021-25487
    61Bu hafta

    Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it res

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    samsung · android6 Eki 2021

  • CVE-2021-25489
    52Planlayın

    Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format st

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %0

    samsung · android6 Eki 2021

  • CVE-2021-32172
    59Planlayın

    Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.

    KritikCVSS 9,8Kavram kanıtıEPSS %66

    maianscriptworld · maian cart7 Eki 2021

  • CVE-2021-22930
    50Planlayın

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c

    KritikCVSS 9,8İstismar yokEPSS %36

    nodejs · node.js7 Eki 2021

  • CVE-2021-40978
    35İzleyin

    The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive infor

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    mkdocs · mkdocs7 Eki 2021

  • CVE-2021-37918
    61Bu hafta

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %73

    zohocorp · manageengine admanager plus7 Eki 2021

  • CVE-2021-37919
    42Planlayın

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %10

    zohocorp · manageengine admanager plus7 Eki 2021

  • CVE-2021-37920
    42Planlayın

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %10

    zohocorp · manageengine admanager plus7 Eki 2021

  • CVE-2021-37921
    42Planlayın

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %10

    zohocorp · manageengine admanager plus7 Eki 2021

  • CVE-2021-37923
    42Planlayın

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %10

    zohocorp · manageengine admanager plus7 Eki 2021

  • CVE-2021-37924
    42Planlayın

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %10

    zohocorp · manageengine admanager plus7 Eki 2021

  • CVE-2021-37926
    61Bu hafta

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    KritikCVSS 9,8İstismar yokEPSS %73

    zohocorp · manageengine admanager plus7 Eki 2021

  • CVE-2021-42013
    99Hemen

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    apache · http server7 Eki 2021

  • CVE-2021-42071
    60Bu hafta

    In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/

    KritikCVSS 9,8Kavram kanıtıEPSS %69

    visual-tools · dvr vx16 firmware7 Eki 2021

  • CVE-2021-30625
    38İzleyin

    Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a maliciou

    YüksekCVSS 8,8İstismar yokEPSS %10

    google · chrome8 Eki 2021

  • CVE-2021-30632
    84Hemen

    Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a craf

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %63

    google · chrome8 Eki 2021

  • CVE-2021-30633
    78Bu hafta

    Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process t

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %33

    google · chrome8 Eki 2021

  • CVE-2021-37973
    72Bu hafta

    Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to poten

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %11

    google · chrome8 Eki 2021

  • CVE-2021-37975
    75Bu hafta

    Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted H

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %34

    google · chrome8 Eki 2021

  • CVE-2021-37976
    62Bu hafta

    Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive info

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %19

    google · chrome8 Eki 2021

  • CVE-2021-24563
    32İzleyin

    Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %26

    frontend uploader project · frontend uploader11 Eki 2021

  • CVE-2021-33730
    36İzleyin

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    YüksekCVSS 7,2İstismar yokEPSS %27

    siemens · sinec nms12 Eki 2021

  • CVE-2021-33731
    42Planlayın

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    YüksekCVSS 7,2İstismar yokEPSS %46

    siemens · sinec nms12 Eki 2021

  • CVE-2021-33732
    36İzleyin

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    YüksekCVSS 7,2İstismar yokEPSS %27

    siemens · sinec nms12 Eki 2021

  • CVE-2021-33733
    33İzleyin

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    YüksekCVSS 7,2İstismar yokEPSS %15

    siemens · sinec nms12 Eki 2021

  • CVE-2021-33734
    36İzleyin

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    YüksekCVSS 7,2İstismar yokEPSS %27

    siemens · sinec nms12 Eki 2021

  • CVE-2021-38454
    45Planlayın

    Moxa MXview Network Management Software

    KritikCVSS 10,0İstismar yokEPSS %15

    moxa · mxview12 Eki 2021

  • CVE-2021-42325
    43Planlayın

    Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    froxlor · froxlor12 Eki 2021

  • CVE-2021-20031
    28İzleyin

    A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary w

    OrtaCVSS 6,1Kavram kanıtıEPSS %13

    sonicwall · sonicos12 Eki 2021

  • CVE-2021-40449
    86Hemen

    Win32k Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %81

    microsoft · windows 10 150712 Eki 2021

  • CVE-2021-40450
    61Bu hafta

    Win32k Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    microsoft · windows 10 180912 Eki 2021

  • CVE-2021-40487
    46Planlayın

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %48

    microsoft · sharepoint enterprise server12 Eki 2021

  • CVE-2021-41355
    28İzleyin

    .NET Core and Visual Studio Information Disclosure Vulnerability

    OrtaCVSS 5,7İstismar yokEPSS %20

    microsoft · .net12 Eki 2021

  • CVE-2021-41357
    61Bu hafta

    Win32k Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    microsoft · windows 10 200412 Eki 2021

  • CVE-2021-20123
    87Hemen

    A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet e

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %90

    draytek · vigorconnect13 Eki 2021

  • CVE-2021-20124
    89Hemen

    A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %96

    draytek · vigorconnect13 Eki 2021

  • CVE-2021-20130
    45Planlayın

    ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file u

    YüksekCVSS 8,8İstismar yokEPSS %32

    zohocorp · manageengine admanager plus13 Eki 2021

  • CVE-2021-20131
    40Planlayın

    ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file u

    YüksekCVSS 8,8İstismar yokEPSS %16

    zohocorp · manageengine admanager plus13 Eki 2021

  • CVE-2021-40493
    54Planlayın

    Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module.

    KritikCVSS 9,8İstismar yokEPSS %50

    zohocorp · manageengine opmanager13 Eki 2021

  • CVE-2021-42342
    57Planlayın

    An issue was discovered in GoAhead 4.x and 5.x before 5.1.5.

    KritikCVSS 9,8Kavram kanıtıEPSS %59

    embedthis · goahead14 Eki 2021

  • CVE-2021-33177
    38İzleyin

    The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection.

    YüksekCVSS 8,8İstismar yokEPSS %10

    nagios · nagios xi14 Eki 2021

  • CVE-2021-33179
    28İzleyin

    The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting.

    OrtaCVSS 6,1İstismar yokEPSS %11

    nagios · nagios xi14 Eki 2021

  • CVE-2021-42340
    34İzleyin

    DoS via memory leak with WebSocket connections

    YüksekCVSS 7,5İstismar yokEPSS %11

    apache · tomcat14 Eki 2021

  • CVE-2021-40728
    47Planlayın

    Adobe Acrobat Reader DC Use After Free Arbitrary Code Execution

    YüksekCVSS 7,8İstismar yokEPSS %54

    adobe · acrobat dc15 Eki 2021

  • CVE-2021-27561
    94Hemen

    Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authenticati

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %82

    yealink · device management15 Eki 2021

  • CVE-2018-16060
    36İzleyin

    Mitsubishi Electric Europe B.V.

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    mitsubishielectric · smartrtu firmware15 Eki 2021

  • CVE-2021-38297
    42Planlayın

    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    golang · go18 Eki 2021

  • CVE-2021-21796
    36İzleyin

    An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.

    YüksekCVSS 7,8İstismar yokEPSS %15

    gonitro · nitro pro18 Eki 2021

  • CVE-2021-21797
    36İzleyin

    An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.

    YüksekCVSS 7,8İstismar yokEPSS %15

    gonitro · nitro pro18 Eki 2021

  • CVE-2021-38389
    42Planlayın

    Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute

    KritikCVSS 9,8İstismar yokEPSS %10

    advantech · webaccess18 Eki 2021

  • CVE-2021-30358
    36İzleyin

    Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from oth

    YüksekCVSS 7,2İstismar yokEPSS %27

    checkpoint · mobile access portal agent19 Eki 2021

  • CVE-2021-30807
    70Bu hafta

    A memory corruption issue was addressed with improved memory handling.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %28

    apple · ipados19 Eki 2021

  • CVE-2021-35559
    26İzleyin

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing).

    OrtaCVSS 5,3İstismar yokEPSS %15

    oracle · graalvm20 Eki 2021

  • CVE-2021-35590
    52Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %88

    oracle · mysql cluster20 Eki 2021

  • CVE-2021-35592
    41Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %52

    oracle · mysql cluster20 Eki 2021

  • CVE-2021-35593
    40Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %51

    oracle · mysql cluster20 Eki 2021

  • CVE-2021-35594
    40Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %51

    oracle · mysql cluster20 Eki 2021

  • CVE-2021-35598
    40Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %51

    oracle · mysql cluster20 Eki 2021

  • CVE-2021-35616
    29İzleyin

    Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure).

    OrtaCVSS 5,4Kavram kanıtıEPSS %27

    oracle · transportation management20 Eki 2021

  • CVE-2021-35621
    40Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %50

    oracle · mysql cluster20 Eki 2021

  • CVE-2021-21745
    34İzleyin

    ZTE MF971R product has a Referer authentication bypass vulnerability.

    OrtaCVSS 4,3Kavram kanıtıEPSS %55

    zte · mf971r firmware20 Eki 2021

  • CVE-2021-41163
    45Planlayın

    RCE via malicious SNS subscription payload

    KritikCVSS 9,8İstismar yokEPSS %19

    discourse · discourse20 Eki 2021

  • CVE-2021-39352
    45Planlayın

    Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload

    YüksekCVSS 7,2SilahlaştırılmışEPSS %56

    catchplugins · catch themes demo import21 Eki 2021

  • CVE-2021-31682
    27İzleyin

    The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks

    OrtaCVSS 6,1Kavram kanıtıEPSS %10

    automatedlogic · webctrl22 Eki 2021

  • CVE-2021-42840
    53Planlayın

    SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %58

    salesagility · suitecrm22 Eki 2021

  • CVE-2021-42258
    91Hemen

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %74

    bqe · billquick web suite22 Eki 2021

  • CVE-2021-38294
    64Bu hafta

    Shell Command Injection Vulnerability in Nimbus Thrift Server

    KritikCVSS 9,8SilahlaştırılmışEPSS %83

    apache · storm25 Eki 2021

  • CVE-2021-40865
    58Planlayın

    Unsafe Pre-Authentication Deserialization In Workers

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    apache · storm25 Eki 2021

  • CVE-2021-20837
    65Bu hafta

    Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r

    KritikCVSS 9,8Kavram kanıtıEPSS %88

    sixapart · movable type26 Eki 2021

  • CVE-2021-34586
    34İzleyin

    CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)

    YüksekCVSS 7,5İstismar yokEPSS %13

    codesys · codesys26 Eki 2021

  • CVE-2021-40344
    47Planlayın

    An issue was discovered in Nagios XI 5.8.5.

    YüksekCVSS 7,2İstismar yokEPSS %64

    nagios · nagios xi26 Eki 2021

  • CVE-2021-40345
    35İzleyin

    An issue was discovered in Nagios XI 5.8.5.

    YüksekCVSS 7,2Kavram kanıtıEPSS %22

    nagios · nagios xi26 Eki 2021

  • CVE-2021-41182
    36İzleyin

    XSS in the `altField` option of the Datepicker widget

    OrtaCVSS 6,1Kavram kanıtıEPSS %39

    jqueryui · jquery ui26 Eki 2021

  • CVE-2021-41184
    36İzleyin

    XSS in the `of` option of the `.position()` util

    OrtaCVSS 6,1Kavram kanıtıEPSS %40

    jqueryui · jquery ui26 Eki 2021

  • CVE-2021-25219
    24İzleyin

    Lame cache can be abused to severely degrade resolver performance

    OrtaCVSS 5,3İstismar yokEPSS %10

    isc · bind27 Eki 2021

  • CVE-2021-30833
    35İzleyin

    This issue was addressed with improved checks.

    OrtaCVSS 5,5İstismar yokEPSS %42

    apple · mac os x28 Eki 2021

  • CVE-2021-1120
    28İzleyin

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be p

    YüksekCVSS 7,0İstismar yokEPSS %0

    nvidia · virtual gpu29 Eki 2021