İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2021: sömürülen ve yeni ciddi CVE kayıtları

79 kayıt · 15 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2021-33265
    43Planlayın

    D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability

    KritikCVSS 9,8İstismar yokEPSS %13

    dlink · dir-809 firmware1 Ara 2021

  • CVE-2021-33266
    44Planlayın

    D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability

    KritikCVSS 9,8İstismar yokEPSS %16

    dlink · dir-809 firmware1 Ara 2021

  • CVE-2021-44352
    43Planlayın

    A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in g

    KritikCVSS 9,8İstismar yokEPSS %13

    tendacn · ac15 firmware3 Ara 2021

  • CVE-2021-23758
    94Hemen

    Deserialization of Untrusted Data

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %82

    ajaxpro.2 project · ajaxpro.23 Ara 2021

  • CVE-2021-24917
    52Planlayın

    WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

    YüksekCVSS 7,5SilahlaştırılmışEPSS %72

    wpserveur · wps hide login6 Ara 2021

  • CVE-2021-24931
    63Bu hafta

    Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection

    KritikCVSS 9,8SilahlaştırılmışEPSS %78

    ays-pro · secure copy content protection and content locking6 Ara 2021

  • CVE-2021-43936
    50Planlayın

    Distributed Data Systems WebHM

    KritikCVSS 9,8Kavram kanıtıEPSS %35

    webhmi · webhmi firmware6 Ara 2021

  • CVE-2021-42125
    59Planlayın

    An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to

    YüksekCVSS 8,8İstismar yokEPSS %81

    ivanti · avalanche7 Ara 2021

  • CVE-2021-42127
    59Planlayın

    A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execu

    KritikCVSS 9,8İstismar yokEPSS %65

    ivanti · avalanche7 Ara 2021

  • CVE-2021-42129
    58Planlayın

    A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform

    YüksekCVSS 8,8İstismar yokEPSS %77

    ivanti · avalanche7 Ara 2021

  • CVE-2021-42130
    54Planlayın

    A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Ser

    YüksekCVSS 8,8İstismar yokEPSS %62

    ivanti · avalanche7 Ara 2021

  • CVE-2021-42131
    55Planlayın

    A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privi

    YüksekCVSS 8,8İstismar yokEPSS %66

    ivanti · avalanche7 Ara 2021

  • CVE-2021-42132
    56Planlayın

    A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform

    YüksekCVSS 8,8İstismar yokEPSS %70

    ivanti · avalanche7 Ara 2021

  • CVE-2021-40859
    61Bu hafta

    Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management app

    KritikCVSS 9,8Kavram kanıtıEPSS %71

    auerswald · compact 5500r firmware7 Ara 2021

  • CVE-2021-43798
    87Hemen

    Grafana path traversal

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %88

    grafana · grafana7 Ara 2021

  • CVE-2021-38759
    44Planlayın

    Raspberry Pi OS through 5.10 has the raspberry default password for the pi account.

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    raspberrypi · raspberry pi os lite7 Ara 2021

  • CVE-2021-20038
    99Hemen

    A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthentic

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    sonicwall · sma 200 firmware8 Ara 2021

  • CVE-2021-20039
    59Planlayın

    Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenti

    YüksekCVSS 8,8SilahlaştırılmışEPSS %78

    sonicwall · sma 200 firmware8 Ara 2021

  • CVE-2021-20040
    38İzleyin

    A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or

    YüksekCVSS 7,5İstismar yokEPSS %25

    sonicwall · sma 200 firmware8 Ara 2021

  • CVE-2021-20041
    36İzleyin

    An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfile

    YüksekCVSS 7,5İstismar yokEPSS %21

    sonicwall · sma 200 firmware8 Ara 2021

  • CVE-2021-20043
    42Planlayın

    A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially exe

    YüksekCVSS 8,8İstismar yokEPSS %23

    sonicwall · sma 200 firmware8 Ara 2021

  • CVE-2021-20044
    47Planlayın

    A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system

    YüksekCVSS 8,8İstismar yokEPSS %40

    sonicwall · sma 200 firmware8 Ara 2021

  • CVE-2021-20045
    47Planlayın

    A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potential

    KritikCVSS 9,8İstismar yokEPSS %25

    sonicwall · sma 200 firmware8 Ara 2021

  • CVE-2021-27860
    77Bu hafta

    Arbitrary file upload vulnerability in FatPipe software

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %39

    fatpipeinc · ipvpn firmware8 Ara 2021

  • CVE-2021-43527
    44Planlayın

    NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-

    KritikCVSS 9,8İstismar yokEPSS %17

    mozilla · nss8 Ara 2021

  • CVE-2021-44529
    99Hemen

    A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code wit

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    ivanti · endpoint manager cloud services appliance8 Ara 2021

  • CVE-2021-3817
    51Planlayın

    SQL Injection in wbce/wbce_cms

    KritikCVSS 9,8Kavram kanıtıEPSS %38

    wbce · wbce cms9 Ara 2021

  • CVE-2021-43803
    44Planlayın

    Unexpected server crash in Next.js

    YüksekCVSS 7,5İstismar yokEPSS %47

    vercel · next.js9 Ara 2021

  • CVE-2021-44228
    100Hemen

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %99

    apache · log4j10 Ara 2021

  • CVE-2021-43813
    34İzleyin

    Directory Traversal in Grafana

    OrtaCVSS 4,3İstismar yokEPSS %57

    grafana · grafana10 Ara 2021

  • CVE-2021-41805
    45Planlayın

    HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control.

    YüksekCVSS 8,8Kavram kanıtıEPSS %34

    hashicorp · consul12 Ara 2021

  • CVE-2021-44515
    99Hemen

    Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in th

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    zohocorp · manageengine desktop central12 Ara 2021

  • CVE-2021-44848
    28İzleyin

    In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whet

    OrtaCVSS 5,3Kavram kanıtıEPSS %22

    cybelesoft · thinfinity virtualui12 Ara 2021

  • CVE-2021-40856
    45Planlayın

    Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.

    YüksekCVSS 7,5Kavram kanıtıEPSS %50

    auerswald · comfortel 3600 ip firmware13 Ara 2021

  • CVE-2021-44152
    57Planlayın

    An issue was discovered in Reprise RLM 14.2.

    KritikCVSS 9,8Kavram kanıtıEPSS %58

    reprisesoftware · reprise license manager13 Ara 2021

  • CVE-2021-24946
    61Bu hafta

    Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection

    KritikCVSS 9,8SilahlaştırılmışEPSS %72

    webnus · modern events calendar lite13 Ara 2021

  • CVE-2021-39935
    71Bu hafta

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %36

    gitlab · gitlab13 Ara 2021

  • CVE-2021-4104
    54Planlayın

    Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

    YüksekCVSS 7,5Kavram kanıtıEPSS %80

    apache · log4j14 Ara 2021

  • CVE-2021-39312
    53Planlayın

    True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

    YüksekCVSS 7,5Kavram kanıtıEPSS %77

    trueranker · true ranker14 Ara 2021

  • CVE-2021-42063
    31İzleyin

    A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50.

    OrtaCVSS 6,1Kavram kanıtıEPSS %23

    sap · knowledge warehouse14 Ara 2021

  • CVE-2021-45046
    96Hemen

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    KritikCVSS 9,0KEVSilahlaştırılmışEPSS %99

    apache · log4j14 Ara 2021

  • CVE-2021-4044
    45Planlayın

    Invalid handling of X509_verify_cert() internal errors in libssl

    YüksekCVSS 7,5Kavram kanıtıEPSS %50

    openssl · openssl14 Ara 2021

  • CVE-2021-43829
    53Planlayın

    Unrestricted Upload of Files in Patrowl

    YüksekCVSS 8,8İstismar yokEPSS %59

    patrowl · patrowlmanager14 Ara 2021

  • CVE-2021-36450
    43Planlayın

    Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.

    OrtaCVSS 6,1Kavram kanıtıEPSS %64

    verint · workforce optimization15 Ara 2021

  • CVE-2021-41560
    42Planlayın

    OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    opencats · opencats15 Ara 2021

  • CVE-2021-45043
    40Planlayın

    HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.

    YüksekCVSS 7,5Kavram kanıtıEPSS %33

    hd-network real-time monitoring system project · hd-network real-time monitoring system15 Ara 2021

  • CVE-2021-43226
    62Bu hafta

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    microsoft · windows 10 150715 Ara 2021

  • CVE-2021-43883
    35İzleyin

    Windows Installer Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %12

    microsoft · windows 1015 Ara 2021

  • CVE-2021-43890
    61Bu hafta

    Windows AppX Installer Spoofing Vulnerability

    YüksekCVSS 7,1KEVSilahlaştırılmışEPSS %11

    microsoft · app installer15 Ara 2021

  • CVE-2021-0920
    55Planlayın

    In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition.

    OrtaCVSS 6,4KEVSilahlaştırılmışEPSS %0

    linux · linux kernel15 Ara 2021

  • CVE-2021-43891
    35İzleyin

    Visual Studio Code Remote Code Execution Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %13

    microsoft · visual studio code15 Ara 2021

  • CVE-2021-1048
    61Bu hafta

    In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    google · android15 Ara 2021

  • CVE-2021-4119
    47Planlayın

    Improper Access Control in bookstackapp/bookstack

    KritikCVSS 9,8İstismar yokEPSS %26

    bookstackapp · bookstack15 Ara 2021

  • CVE-2021-45092
    51Planlayın

    Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath paramete

    KritikCVSS 9,8Kavram kanıtıEPSS %40

    cybelesoft · thinfinity virtualui16 Ara 2021

  • CVE-2021-42912
    38İzleyin

    FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability.

    YüksekCVSS 8,8İstismar yokEPSS %10

    fiberhome · an5506-01-a firmware16 Ara 2021

  • CVE-2021-41843
    30İzleyin

    An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from al

    OrtaCVSS 6,5İstismar yokEPSS %12

    open-emr · openemr17 Ara 2021

  • CVE-2021-22054
    90Hemen

    VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    vmware · workspace one uem console17 Ara 2021

  • CVE-2021-23450
    48Planlayın

    All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

    KritikCVSS 9,8İstismar yokEPSS %30

    linuxfoundation · dojo17 Ara 2021

  • CVE-2021-45105
    53Planlayın

    Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

    OrtaCVSS 5,9Kavram kanıtıEPSS %99

    apache · log4j18 Ara 2021

  • CVE-2021-44224
    57Planlayın

    Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

    YüksekCVSS 8,2İstismar yokEPSS %82

    apache · http server20 Ara 2021

  • CVE-2021-44790
    68Bu hafta

    Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

    KritikCVSS 9,8Kavram kanıtıEPSS %96

    apache · http server20 Ara 2021

  • CVE-2020-19316
    36İzleyin

    OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

    YüksekCVSS 8,8İstismar yokEPSS %2

    laravel · framework20 Ara 2021

  • CVE-2021-24750
    46Planlayın

    WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

    YüksekCVSS 8,8Kavram kanıtıEPSS %38

    codepress · visitor statistics21 Ara 2021

  • CVE-2021-44207
    67Bu hafta

    Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %17

    acclaimsystems · usaherds21 Ara 2021

  • CVE-2021-36750
    36İzleyin

    ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVau

    YüksekCVSS 8,1Kavram kanıtıEPSS %13

    zendesk · enc datavault22 Ara 2021

  • CVE-2021-21881
    50Planlayın

    An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0

    KritikCVSS 9,9Kavram kanıtıEPSS %36

    lantronix · premierwave 2050 firmware22 Ara 2021

  • CVE-2021-21892
    48Planlayın

    A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QE

    KritikCVSS 9,9İstismar yokEPSS %30

    lantronix · premierwave 2050 firmware22 Ara 2021

  • CVE-2021-21924
    32İzleyin

    A specially-crafted HTTP request can lead to SQL injection.

    OrtaCVSS 6,5İstismar yokEPSS %20

    advantech · r-seenet22 Ara 2021

  • CVE-2021-31558
    27İzleyin

    Delta Electronics DIAEnergie (Update A)

    OrtaCVSS 6,1İstismar yokEPSS %10

    deltaww · diaenergie22 Ara 2021

  • CVE-2021-40417
    44Planlayın

    When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that we

    KritikCVSS 9,8İstismar yokEPSS %15

    blackmagicdesign · davinci resolve22 Ara 2021

  • CVE-2021-40418
    44Planlayın

    When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property

    KritikCVSS 9,8İstismar yokEPSS %17

    blackmagicdesign · davinci resolve22 Ara 2021

  • CVE-2021-45461
    45Planlayın

    FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to exec

    KritikCVSS 9,8İstismar yokEPSS %21

    sangoma · restapps22 Ara 2021

  • CVE-2021-45511
    44Planlayın

    Certain NETGEAR devices are affected by authentication bypass.

    KritikCVSS 9,8SilahlaştırılmışEPSS %17

    netgear · ac2100 firmware25 Ara 2021

  • CVE-2021-45232
    65Bu hafta

    security vulnerability on unauthorized access.

    KritikCVSS 9,8Kavram kanıtıEPSS %86

    apache · apisix dashboard27 Ara 2021

  • CVE-2021-43857
    52Planlayın

    Gerapy may contain remote code execution vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %55

    gerapy · gerapy27 Ara 2021

  • CVE-2021-43858
    46Planlayın

    User privilege escalation in MinIO

    YüksekCVSS 8,8Kavram kanıtıEPSS %35

    minio · minio27 Ara 2021

  • CVE-2021-44832
    55Planlayın

    Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

    OrtaCVSS 6,6Kavram kanıtıEPSS %97

    apache · log4j28 Ara 2021

  • CVE-2021-45427
    45Planlayın

    Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal.

    KritikCVSS 9,8İstismar yokEPSS %19

    emerson · xweb300d evo firmware30 Ara 2021

  • CVE-2021-20150
    33İzleyin

    Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard.

    OrtaCVSS 5,3Kavram kanıtıEPSS %40

    trendnet · tew-827dru firmware30 Ara 2021