İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2022: sömürülen ve yeni ciddi CVE kayıtları

67 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2021-24786
    33İzleyin

    Download Monitor < 4.4.5 - Admin+ SQL Injection

    YüksekCVSS 7,2Kavram kanıtıEPSS %17

    wpchill · download monitor3 Oca 2022

  • CVE-2021-45428
    56Planlayın

    TLR-2005KSH is affected by an incorrect access control vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    telesquare · tlr-2005ksh firmware3 Oca 2022

  • CVE-2021-43942
    41Planlayın

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cro

    OrtaCVSS 6,1İstismar yokEPSS %55

    atlassian · jira server3 Oca 2022

  • CVE-2021-44168
    61Bu hafta

    A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    fortinet · fortios4 Oca 2022

  • CVE-2021-43711
    50Planlayın

    The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET paramete

    KritikCVSS 9,8İstismar yokEPSS %37

    totolink · ex200 firmware4 Oca 2022

  • CVE-2022-21647
    50Planlayın

    Deserialization of Untrusted Data in Codeigniter4

    KritikCVSS 9,8İstismar yokEPSS %37

    codeigniter · codeigniter4 Oca 2022

  • CVE-2021-31589
    32İzleyin

    A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1

    OrtaCVSS 6,1Kavram kanıtıEPSS %25

    beyondtrust · appliance base software5 Oca 2022

  • CVE-2021-45456
    66Bu hafta

    Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user.

    KritikCVSS 9,8İstismar yokEPSS %88

    apache · kylin6 Oca 2022

  • CVE-2022-21661
    59Planlayın

    SQL injection in WordPress

    YüksekCVSS 7,5Kavram kanıtıEPSS %97

    wordpress · wordpress6 Oca 2022

  • CVE-2022-21662
    40Planlayın

    Stored XSS in WordPress

    OrtaCVSS 5,4İstismar yokEPSS %64

    wordpress · wordpress6 Oca 2022

  • CVE-2021-35247
    60Bu hafta

    Improper Input Validation Vulnerability in Serv-U

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %3

    solarwinds · serv-u10 Oca 2022

  • CVE-2021-42392
    64Bu hafta

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

    KritikCVSS 9,8Kavram kanıtıEPSS %83

    h2database · h210 Oca 2022

  • CVE-2022-22265
    61Bu hafta

    An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    google · android10 Oca 2022

  • CVE-2021-24862
    50Planlayın

    RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection

    YüksekCVSS 7,2SilahlaştırılmışEPSS %73

    metagauss · registrationmagic10 Oca 2022

  • CVE-2021-43297
    44Planlayın

    Dubbo Hessian cause RCE when parse error

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    apache · dubbo10 Oca 2022

  • CVE-2022-21881
    35İzleyin

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,0Kavram kanıtıEPSS %24

    microsoft · windows 1011 Oca 2022

  • CVE-2022-21882
    79Bu hafta

    Win32k Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %59

    microsoft · windows 10 180911 Oca 2022

  • CVE-2022-21907
    67Bu hafta

    HTTP Protocol Stack Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %92

    microsoft · windows 1011 Oca 2022

  • CVE-2022-21919
    59Planlayın

    Windows User Profile Service Elevation of Privilege Vulnerability

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %2

    microsoft · windows 10 150711 Oca 2022

  • CVE-2021-42561
    41Planlayın

    An issue was discovered in CALDERA 2.8.1.

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    mitre · caldera12 Oca 2022

  • CVE-2022-20615
    46Planlayın

    Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resultin

    OrtaCVSS 5,4İstismar yokEPSS %81

    jenkins · matrix project12 Oca 2022

  • CVE-2022-23111
    25İzleyin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an atta

    OrtaCVSS 4,3İstismar yokEPSS %26

    jenkins · publish over ssh12 Oca 2022

  • CVE-2022-23131
    98Hemen

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95

    zabbix · zabbix13 Oca 2022

  • CVE-2022-23134
    80Hemen

    Possible view of the setup pages by unauthenticated users if config file already exists

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %95

    zabbix · zabbix13 Oca 2022

  • CVE-2021-34995
    56Planlayın

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.

    YüksekCVSS 8,8İstismar yokEPSS %68

    commvault · commcell13 Oca 2022

  • CVE-2021-34996
    60Bu hafta

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.

    YüksekCVSS 8,8İstismar yokEPSS %82

    commvault · commcell13 Oca 2022

  • CVE-2022-23227
    84Hemen

    NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %48

    nuuo · nvrmini2 firmware14 Oca 2022

  • CVE-2021-44701
    37İzleyin

    Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %20

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-44703
    48Planlayın

    Adobe Acrobat Pro DC Stack Overflow Vulnerability Arbitrary code execution

    YüksekCVSS 7,8İstismar yokEPSS %57

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-44704
    34İzleyin

    Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution

    YüksekCVSS 7,8İstismar yokEPSS %10

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-44708
    42Planlayın

    Adobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code execution

    YüksekCVSS 7,8İstismar yokEPSS %38

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-44709
    40Planlayın

    Adobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code execution

    YüksekCVSS 7,8İstismar yokEPSS %29

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-44710
    34İzleyin

    Adobe Acrobat Reader Use-after-free could lead to Arbitrary code execution

    YüksekCVSS 7,8İstismar yokEPSS %11

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-44715
    26İzleyin

    Adobe Acrobat Reader DC Out-of-Bounds Read Information Disclosure Vulnerability

    OrtaCVSS 5,5İstismar yokEPSS %14

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-45062
    36İzleyin

    Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %16

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-45064
    34İzleyin

    Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %11

    adobe · acrobat dc14 Oca 2022

  • CVE-2021-45068
    35İzleyin

    Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %12

    adobe · acrobat dc14 Oca 2022

  • CVE-2022-23178
    62Bu hafta

    An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices.

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    crestron · hd-md4x2-4k-e firmware15 Oca 2022

  • CVE-2021-44757
    43Planlayın

    Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, an

    KritikCVSS 9,1İstismar yokEPSS %24

    zohocorp · manageengine desktop central18 Oca 2022

  • CVE-2022-23302
    54Planlayın

    Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

    YüksekCVSS 8,8İstismar yokEPSS %63

    apache · log4j18 Oca 2022

  • CVE-2022-23305
    59Planlayın

    SQL injection in JDBC Appender in Apache Log4j V1

    KritikCVSS 9,8Kavram kanıtıEPSS %66

    apache · log4j18 Oca 2022

  • CVE-2022-23307
    51Planlayın

    A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

    YüksekCVSS 8,8İstismar yokEPSS %54

    apache · chainsaw18 Oca 2022

  • CVE-2021-35587
    98Hemen

    Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %96

    oracle · access manager19 Oca 2022

  • CVE-2022-21279
    49Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %78

    oracle · mysql19 Oca 2022

  • CVE-2022-21280
    48Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %76

    oracle · mysql19 Oca 2022

  • CVE-2022-21371
    58Planlayın

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container).

    YüksekCVSS 7,5Kavram kanıtıEPSS %92

    oracle · weblogic server19 Oca 2022

  • CVE-2022-23221
    58Planlayın

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTING

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    h2database · h219 Oca 2022

  • CVE-2022-23046
    36İzleyin

    PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/r

    YüksekCVSS 7,2Kavram kanıtıEPSS %25

    phpipam · phpipam19 Oca 2022

  • CVE-2022-0281
    33İzleyin

    Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    microweber · microweber20 Oca 2022

  • CVE-2022-22733
    37İzleyin

    Access-Token in ElasticJob UI causes password disclosure

    OrtaCVSS 6,5Kavram kanıtıEPSS %37

    apache · shardingsphere elasticjob-ui20 Oca 2022

  • CVE-2022-23119
    37İzleyin

    A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below coul

    YüksekCVSS 7,5İstismar yokEPSS %22

    linux · linux kernel20 Oca 2022

  • CVE-2022-22930
    46Planlayın

    A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code vi

    KritikCVSS 9,8İstismar yokEPSS %23

    mingsoft · mcms20 Oca 2022

  • CVE-2021-25076
    40Planlayın

    WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

    YüksekCVSS 8,8Kavram kanıtıEPSS %17

    wedevs · wp user frontend24 Oca 2022

  • CVE-2021-25080
    49Planlayın

    Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting

    OrtaCVSS 6,1İstismar yokEPSS %84

    crmperks · contact form entries24 Oca 2022

  • CVE-2022-23437
    29İzleyin

    Infinite loop within Apache XercesJ xml parser

    OrtaCVSS 6,5İstismar yokEPSS %11

    apache · xerces-j24 Oca 2022

  • CVE-2022-23944
    60Bu hafta

    Apache ShenYu 2.4.1 Improper access control

    KritikCVSS 9,1Kavram kanıtıEPSS %79

    apache · shenyu25 Oca 2022

  • CVE-2022-0332
    52Planlayın

    A flaw was found in Moodle in versions 3.11 to 3.11.4.

    KritikCVSS 9,8Kavram kanıtıEPSS %44

    moodle · moodle25 Oca 2022

  • CVE-2021-22600
    60Bu hafta

    Double Free in net/packet/af_packet.c leading to priviledge escalation

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %6

    netapp · 8300 firmware26 Oca 2022

  • CVE-2021-46065
    47Planlayın

    A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attacke

    OrtaCVSS 4,8İstismar yokEPSS %92

    zohocorp · manageengine servicedesk plus27 Oca 2022

  • CVE-2021-23174
    44Planlayın

    WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    OrtaCVSS 4,8İstismar yokEPSS %83

    wpchill · download monitor28 Oca 2022

  • CVE-2021-40407
    72Bu hafta

    An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %47

    reolink · rlc-410w firmware28 Oca 2022

  • CVE-2021-40410
    36İzleyin

    An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

    YüksekCVSS 7,2İstismar yokEPSS %27

    reolink · rlc-410w firmware28 Oca 2022

  • CVE-2021-40412
    36İzleyin

    An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

    YüksekCVSS 7,2İstismar yokEPSS %27

    reolink · rlc-410w firmware28 Oca 2022

  • CVE-2021-4034
    89Hemen

    A local privilege escalation vulnerability was found on polkit's pkexec utility.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %94

    polkit project · polkit28 Oca 2022

  • CVE-2022-24124
    47Planlayın

    The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/g

    YüksekCVSS 7,5Kavram kanıtıEPSS %55

    casbin · casdoor29 Oca 2022

  • CVE-2021-34805
    38İzleyin

    An issue was discovered in FAUST iServer before 9.0.019.019.7.

    YüksekCVSS 7,5Kavram kanıtıEPSS %26

    land-software · faust iserver31 Oca 2022

  • CVE-2022-23409
    23İzleyin

    The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.

    OrtaCVSS 4,9Kavram kanıtıEPSS %13

    ethercreative · logs31 Oca 2022