İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2021: sömürülen ve yeni ciddi CVE kayıtları

71 kayıt · 11 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2021-42574
    37İzleyin

    An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.

    YüksekCVSS 8,3Kavram kanıtıEPSS %12

    unicode · unicode1 Kas 2021

  • CVE-2021-29212
    43Planlayın

    A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90

    KritikCVSS 9,8İstismar yokEPSS %13

    hp · ilo amplifier pack1 Kas 2021

  • CVE-2021-20136
    42Planlayın

    ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite.

    KritikCVSS 9,8İstismar yokEPSS %10

    zohocorp · manageengine log3601 Kas 2021

  • CVE-2021-39341
    39İzleyin

    OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

    YüksekCVSS 8,2Kavram kanıtıEPSS %21

    optinmonster · optinmonster1 Kas 2021

  • CVE-2021-42697
    41Planlayın

    Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote at

    YüksekCVSS 7,5Kavram kanıtıEPSS %36

    akka · http server2 Kas 2021

  • CVE-2021-43267
    56Planlayın

    An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.

    KritikCVSS 9,8Kavram kanıtıEPSS %57

    linux · linux kernel2 Kas 2021

  • CVE-2021-39238
    42Planlayın

    Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buf

    KritikCVSS 9,8İstismar yokEPSS %11

    hp · futuresmart 32 Kas 2021

  • CVE-2021-41174
    50Planlayın

    XSS vulnerability allowing arbitrary JavaScript execution

    OrtaCVSS 6,1Kavram kanıtıEPSS %85

    grafana · grafana3 Kas 2021

  • CVE-2021-38428
    22İzleyin

    Delta Electronics DIALink

    OrtaCVSS 4,8İstismar yokEPSS %11

    deltaww · dialink3 Kas 2021

  • CVE-2021-38488
    23İzleyin

    Delta Electronics DIALink

    OrtaCVSS 4,8İstismar yokEPSS %12

    deltaww · dialink3 Kas 2021

  • CVE-2021-39906
    42Planlayın

    Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vic

    OrtaCVSS 6,1İstismar yokEPSS %60

    gitlab · gitlab4 Kas 2021

  • CVE-2021-42237
    98Hemen

    Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achi

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    sitecore · experience platform5 Kas 2021

  • CVE-2021-42667
    44Planlayın

    A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views.

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    online event booking and reservation system project · online event booking and reservation system5 Kas 2021

  • CVE-2021-42669
    46Planlayın

    A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the ava

    KritikCVSS 9,8Kavram kanıtıEPSS %23

    engineers online portal project · engineers online portal5 Kas 2021

  • CVE-2021-42671
    36İzleyin

    An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploa

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    engineers online portal project · engineers online portal5 Kas 2021

  • CVE-2021-43405
    46Planlayın

    An issue was discovered in FusionPBX before 4.5.30.

    YüksekCVSS 8,8Kavram kanıtıEPSS %35

    fusionpbx · fusionpbx5 Kas 2021

  • CVE-2021-31602
    45Planlayın

    An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.

    YüksekCVSS 7,5Kavram kanıtıEPSS %51

    hitachi · vantara pentaho8 Kas 2021

  • CVE-2021-24827
    43Planlayın

    Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    asgaros · asgaros forum8 Kas 2021

  • CVE-2021-38666
    40Planlayın

    Remote Desktop Client Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %15

    microsoft · windows 109 Kas 2021

  • CVE-2021-41349
    54Planlayın

    Microsoft Exchange Server Spoofing Vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %93

    microsoft · exchange server9 Kas 2021

  • CVE-2021-41379
    58Planlayın

    Windows Installer Elevation of Privilege Vulnerability

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %19

    microsoft · windows 10 15079 Kas 2021

  • CVE-2021-42278
    82Hemen

    Active Directory Domain Services Elevation of Privilege Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %73

    microsoft · windows server 20049 Kas 2021

  • CVE-2021-42287
    83Hemen

    Active Directory Domain Services Elevation of Privilege Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %77

    microsoft · windows server 20049 Kas 2021

  • CVE-2021-42292
    74Bu hafta

    Microsoft Excel Security Feature Bypass Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %43

    microsoft · 365 apps9 Kas 2021

  • CVE-2021-42321
    93Hemen

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %91

    microsoft · exchange server9 Kas 2021

  • CVE-2021-43136
    44Planlayın

    An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to t

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    formalms · formalms10 Kas 2021

  • CVE-2021-3060
    42Planlayın

    PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)

    YüksekCVSS 8,1Kavram kanıtıEPSS %32

    paloaltonetworks · prisma access10 Kas 2021

  • CVE-2021-3064
    45Planlayın

    PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    paloaltonetworks · pan-os10 Kas 2021

  • CVE-2021-22048
    38İzleyin

    The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.

    YüksekCVSS 8,8İstismar yokEPSS %10

    vmware · cloud foundation10 Kas 2021

  • CVE-2021-33618
    48Planlayın

    Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY el

    OrtaCVSS 6,1İstismar yokEPSS %79

    dolibarr · dolibarr erp\/crm10 Kas 2021

  • CVE-2021-41081
    58Planlayın

    Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    zohocorp · manageengine network configuration manager11 Kas 2021

  • CVE-2021-42847
    60Bu hafta

    Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.

    KritikCVSS 9,8SilahlaştırılmışEPSS %70

    zohocorp · manageengine adaudit plus11 Kas 2021

  • CVE-2002-20001
    37İzleyin

    The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not pub

    YüksekCVSS 7,5Kavram kanıtıEPSS %24

    balasys · dheater11 Kas 2021

  • CVE-2021-21699
    48Planlayın

    Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters,

    OrtaCVSS 5,4İstismar yokEPSS %88

    jenkins · active choices12 Kas 2021

  • CVE-2021-43496
    35İzleyin

    Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability.

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    clustering project · clustering12 Kas 2021

  • CVE-2021-3577
    53Planlayın

    An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an att

    YüksekCVSS 8,8Kavram kanıtıEPSS %60

    binatoneglobal · halo\+ camera firmware12 Kas 2021

  • CVE-2021-3840
    36İzleyin

    A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote co

    YüksekCVSS 8,8İstismar yokEPSS %2

    lenovo · antilles12 Kas 2021

  • CVE-2021-41653
    62Bu hafta

    The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution

    KritikCVSS 9,8Kavram kanıtıEPSS %76

    tp-link · tl-wr840n firmware13 Kas 2021

  • CVE-2021-43617
    45Planlayın

    Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/Val

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    laravel · framework14 Kas 2021

  • CVE-2020-16152
    60Bu hafta

    The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers

    KritikCVSS 9,8SilahlaştırılmışEPSS %35

    extremenetworks · aerohive netconfig14 Kas 2021

  • CVE-2021-41765
    59Planlayın

    A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated att

    KritikCVSS 9,8İstismar yokEPSS %67

    montala · resourcespace15 Kas 2021

  • CVE-2021-41950
    58Planlayın

    A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on t

    KritikCVSS 9,1İstismar yokEPSS %74

    montala · resourcespace15 Kas 2021

  • CVE-2021-41951
    47Planlayın

    ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php vi

    OrtaCVSS 6,1Kavram kanıtıEPSS %77

    montala · resourcespace15 Kas 2021

  • CVE-2021-41266
    53Planlayın

    Authentication bypass issue in the Operator Console

    KritikCVSS 9,8Kavram kanıtıEPSS %48

    min · minio console15 Kas 2021

  • CVE-2021-37580
    52Planlayın

    Apache ShenYu Admin bypass JWT authentication

    KritikCVSS 9,8Kavram kanıtıEPSS %42

    apache · shenyu16 Kas 2021

  • CVE-2021-3958
    43Planlayın

    SQL Injection Vulnerability in Ipack SCADA Software

    KritikCVSS 9,8İstismar yokEPSS %14

    ipack · scada automation16 Kas 2021

  • CVE-2021-42362
    59Planlayın

    WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload

    YüksekCVSS 8,8SilahlaştırılmışEPSS %79

    wordpress popular posts project · wordpress popular posts17 Kas 2021

  • CVE-2021-41277
    89Hemen

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %97

    metabase · metabase17 Kas 2021

  • CVE-2021-44026
    90Hemen

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %69

    roundcube · webmail19 Kas 2021

  • CVE-2021-22053
    39İzleyin

    Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    vmware · spring cloud netflix19 Kas 2021

  • CVE-2021-43555
    42Planlayın

    mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vul

    YüksekCVSS 7,8İstismar yokEPSS %38

    myscada · mydesigner19 Kas 2021

  • CVE-2021-38146
    34İzleyin

    The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute p

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    wipro · holmes22 Kas 2021

  • CVE-2021-43557
    34İzleyin

    Path traversal in request_uri variable

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    apache · apisix22 Kas 2021

  • CVE-2021-42727
    43Planlayın

    Adobe Bridge Buffer Overflow Arbitrary code execution

    YüksekCVSS 7,8İstismar yokEPSS %39

    adobe · robohelp server22 Kas 2021

  • CVE-2021-24891
    32İzleyin

    Elementor < 3.4.8 - DOM Cross-Site-Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %25

    elementor · website builder23 Kas 2021

  • CVE-2021-36299
    41Planlayın

    Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability.

    YüksekCVSS 8,1İstismar yokEPSS %29

    dell · emc idrac9 firmware23 Kas 2021

  • CVE-2021-36300
    42Planlayın

    iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.

    YüksekCVSS 8,2İstismar yokEPSS %33

    dell · emc idrac9 firmware23 Kas 2021

  • CVE-2021-36301
    36İzleyin

    Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm.

    YüksekCVSS 7,2İstismar yokEPSS %27

    dell · emc idrac8 firmware23 Kas 2021

  • CVE-2021-38000
    60Bu hafta

    Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitra

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %4

    google · chrome23 Kas 2021

  • CVE-2021-38001
    43Planlayın

    Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted H

    YüksekCVSS 8,8Kavram kanıtıEPSS %26

    google · chrome23 Kas 2021

  • CVE-2021-38003
    77Bu hafta

    Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption v

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %38

    google · chrome23 Kas 2021

  • CVE-2021-42783
    40Planlayın

    Missing Authentication in debug_post_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4

    KritikCVSS 9,8İstismar yokEPSS %3

    dlink · dwr-932c e1 firmware23 Kas 2021

  • CVE-2021-43778
    46Planlayın

    Path traversal in GLPI barcode plugin

    YüksekCVSS 7,5Kavram kanıtıEPSS %52

    glpi-project · barcode24 Kas 2021

  • CVE-2021-44223
    48Planlayın

    WordPress before 5.8 lacks support for the Update URI plugin header.

    KritikCVSS 9,8İstismar yokEPSS %28

    wordpress · wordpress25 Kas 2021

  • CVE-2021-44077
    97Hemen

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    zohocorp · manageengine servicedesk plus29 Kas 2021

  • CVE-2021-21707
    29İzleyin

    Special characters break path parsing in XML functions

    OrtaCVSS 5,3Kavram kanıtıEPSS %25

    php · php29 Kas 2021

  • CVE-2021-38147
    46Planlayın

    Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti

    YüksekCVSS 7,5Kavram kanıtıEPSS %53

    wipro · holmes29 Kas 2021

  • CVE-2021-24915
    42Planlayın

    Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    contest gallery · contest gallery29 Kas 2021

  • CVE-2021-43788
    28İzleyin

    Path traversal in translator module of NobeBB

    OrtaCVSS 5,0İstismar yokEPSS %25

    nodebb · nodebb29 Kas 2021

  • CVE-2021-44427
    54Planlayın

    An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers t

    KritikCVSS 9,8Kavram kanıtıEPSS %50

    rosariosis · rosariosis29 Kas 2021

  • CVE-2021-43319
    45Planlayın

    Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping func

    KritikCVSS 9,8İstismar yokEPSS %21

    zohocorp · manageengine network configuration manager30 Kas 2021