İçeriğe atla
Noroxi

Yayın tarihine göre

Mart 2022: sömürülen ve yeni ciddi CVE kayıtları

123 kayıt · 16 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2021-20323
    35İzleyin

    A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

    OrtaCVSS 6,1Kavram kanıtıEPSS %37

    redhat · keycloak25 Mar 2022

  • CVE-2022-0435
    55Planlayın

    A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content wh

    YüksekCVSS 8,8Kavram kanıtıEPSS %67

    linux · linux kernel25 Mar 2022

  • CVE-2022-0995
    64Bu hafta

    An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %8

    linux · linux kernel25 Mar 2022

  • CVE-2022-22274
    62Bu hafta

    A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Serv

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    sonicwall · sonicos25 Mar 2022

  • CVE-2022-26245
    43Planlayın

    Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.

    KritikCVSS 9,8İstismar yokEPSS %14

    open-falcon · falcon-plus27 Mar 2022

  • CVE-2022-26258
    96Hemen

    D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91

    dlink · dir-820l firmware27 Mar 2022

  • CVE-2021-26598
    24İzleyin

    ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by d

    OrtaCVSS 5,3Kavram kanıtıEPSS %10

    impresscms · impresscms27 Mar 2022

  • CVE-2021-26599
    45Planlayın

    ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    impresscms · impresscms27 Mar 2022

  • CVE-2022-0342
    68Bu hafta

    An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fi

    KritikCVSS 9,8Kavram kanıtıEPSS %95

    zyxel · usg40 firmware28 Mar 2022

  • CVE-2022-0479
    52Planlayın

    Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    sygnoos · popup builder28 Mar 2022

  • CVE-2022-0595
    25İzleyin

    Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS

    OrtaCVSS 5,4Kavram kanıtıEPSS %13

    codedropz · drag and drop multiple file upload - contact form 728 Mar 2022

  • CVE-2022-0679
    53Planlayın

    Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

    KritikCVSS 9,8Kavram kanıtıEPSS %47

    narnoo distributor project · narnoo distributor28 Mar 2022

  • CVE-2022-0784
    42Planlayın

    Title Experiments Free < 9.0.1 - Unauthenticated SQLi

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    title experiments free project · title experiments free28 Mar 2022

  • CVE-2021-4191
    60Bu hafta

    An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2.

    OrtaCVSS 5,3SilahlaştırılmışEPSS %80

    gitlab · gitlab28 Mar 2022

  • CVE-2022-0735
    43Planlayın

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 befor

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    gitlab · gitlab28 Mar 2022

  • CVE-2022-25347
    33İzleyin

    Delta Electronics DIAEnergie Path Traversal

    YüksekCVSS 7,5İstismar yokEPSS %11

    deltaww · diaenergie29 Mar 2022

  • CVE-2022-22948
    60Bu hafta

    The vCenter Server contains an information disclosure vulnerability due to improper permission of files.

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %13

    vmware · cloud foundation29 Mar 2022

  • CVE-2021-43118
    49Planlayın

    A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 vi

    KritikCVSS 9,8İstismar yokEPSS %34

    draytek · vigor2960 firmware29 Mar 2022

  • CVE-2022-26871
    75Bu hafta

    An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary fil

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %19

    trendmicro · apex central29 Mar 2022

  • CVE-2022-1178
    36İzleyin

    Stored Cross Site Scripting in openemr/openemr

    OrtaCVSS 5,4İstismar yokEPSS %51

    open-emr · openemr30 Mar 2022

  • CVE-2022-1179
    44Planlayın

    Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr

    OrtaCVSS 5,4İstismar yokEPSS %76

    open-emr · openemr30 Mar 2022

  • CVE-2022-1181
    36İzleyin

    Stored Cross Site Scripting in openemr/openemr

    OrtaCVSS 5,4İstismar yokEPSS %51

    open-emr · openemr30 Mar 2022

  • CVE-2021-46009
    43Planlayın

    In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication.

    KritikCVSS 9,8İstismar yokEPSS %12

    totolink · a3100r firmware30 Mar 2022