İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2022: sömürülen ve yeni ciddi CVE kayıtları

103 kayıt · 16 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 2

  • CVE-2022-25017
    44Planlayın

    Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.

    YüksekCVSS 8,8İstismar yokEPSS %29

    hitrontech · chita firmware1 Nis 2022

  • CVE-2022-22963
    99Hemen

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    vmware · spring cloud function1 Nis 2022

  • CVE-2022-22965
    99Hemen

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    vmware · spring framework1 Nis 2022

  • CVE-2022-22950
    37İzleyin

    n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL exp

    OrtaCVSS 6,5İstismar yokEPSS %36

    vmware · spring framework1 Nis 2022

  • CVE-2022-28368
    64Bu hafta

    Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (with

    KritikCVSS 9,8SilahlaştırılmışEPSS %82

    dompdf project · dompdf2 Nis 2022

  • CVE-2022-28379
    40Planlayın

    jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.

    OrtaCVSS 4,8İstismar yokEPSS %71

    nginxproxymanager · nginx proxy manager3 Nis 2022

  • CVE-2022-28381
    60Bu hafta

    Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long st

    KritikCVSS 9,8SilahlaştırılmışEPSS %70

    allmediaserver · allmediaserver3 Nis 2022

  • CVE-2022-26233
    35İzleyin

    Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to acc

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    barco · control room management suite3 Nis 2022

  • CVE-2021-44138
    34İzleyin

    There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    caucho · resin4 Nis 2022

  • CVE-2022-1026
    38İzleyin

    Kyocera Net View Address Book Exposure

    YüksekCVSS 8,6Kavram kanıtıEPSS %14

    kyocera · net viewer4 Nis 2022

  • CVE-2022-24785
    34İzleyin

    Path Traversal in Moment.js

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    momentjs · moment4 Nis 2022

  • CVE-2022-1162
    62Bu hafta

    A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    gitlab · gitlab4 Nis 2022

  • CVE-2022-1175
    49Planlayın

    Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio

    OrtaCVSS 6,1Kavram kanıtıEPSS %82

    gitlab · gitlab4 Nis 2022

  • CVE-2022-1190
    47Planlayın

    Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an atta

    OrtaCVSS 5,4İstismar yokEPSS %87

    gitlab · gitlab4 Nis 2022

  • CVE-2022-0609
    72Bu hafta

    Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a c

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %22

    google · chrome4 Nis 2022

  • CVE-2021-43008
    34İzleyin

    Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on th

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    adminer · adminer4 Nis 2022

  • CVE-2022-26635
    45Planlayın

    PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection.

    KritikCVSS 9,8İstismar yokEPSS %21

    php · memcached5 Nis 2022

  • CVE-2022-28219
    68Bu hafta

    Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.

    KritikCVSS 9,8SilahlaştırılmışEPSS %97

    zohocorp · manageengine adaudit plus5 Nis 2022

  • CVE-2022-26250
    31İzleyin

    Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges.

    YüksekCVSS 7,8İstismar yokEPSS %0

    synametrics · synaman5 Nis 2022

  • CVE-2022-26251
    29İzleyin

    The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileg

    YüksekCVSS 7,2İstismar yokEPSS %1

    synametrics · synaman5 Nis 2022

  • CVE-2021-30497
    59Planlayın

    Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %96

    ivanti · avalanche5 Nis 2022

  • CVE-2021-46417
    48Planlayın

    Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fuelin

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    franklinfueling · colibri firmware7 Nis 2022

  • CVE-2021-46418
    37İzleyin

    An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    telesquare · tlr-2855ks6 firmware7 Nis 2022

  • CVE-2021-46419
    57Planlayın

    An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.

    KritikCVSS 9,1Kavram kanıtıEPSS %71

    telesquare · tlr-2855ks6 firmware7 Nis 2022

  • CVE-2021-43421
    52Planlayın

    A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to

    KritikCVSS 9,8Kavram kanıtıEPSS %42

    std42 · elfinder7 Nis 2022

  • CVE-2021-46367
    37İzleyin

    RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel.

    YüksekCVSS 7,2İstismar yokEPSS %29

    ritecms · ritecms8 Nis 2022

  • CVE-2022-27115
    48Planlayın

    In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.

    KritikCVSS 9,8İstismar yokEPSS %28

    std42 · elfinder11 Nis 2022

  • CVE-2022-22954
    99Hemen

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    vmware · identity manager11 Nis 2022

  • CVE-2022-24838
    49Planlayın

    Command Injection in Appointment Emails for Nextcloud Calendar

    KritikCVSS 9,8İstismar yokEPSS %33

    nextcloud · calendar11 Nis 2022

  • CVE-2022-28346
    45Planlayın

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    djangoproject · django12 Nis 2022

  • CVE-2022-23450
    50Planlayın

    A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions

    KritikCVSS 9,8İstismar yokEPSS %35

    siemens · simatic energy manager basic12 Nis 2022

  • CVE-2022-24248
    32İzleyin

    RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel.

    OrtaCVSS 6,5İstismar yokEPSS %20

    ritecms · ritecms12 Nis 2022

  • CVE-2021-31805
    65Bu hafta

    Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

    KritikCVSS 9,8Kavram kanıtıEPSS %85

    apache · struts12 Nis 2022

  • CVE-2022-28213
    36İzleyin

    When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently vali

    YüksekCVSS 8,1Kavram kanıtıEPSS %12

    sap · businessobjects business intelligence platform12 Nis 2022

  • CVE-2022-29036
    43Planlayın

    Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does n

    OrtaCVSS 5,4İstismar yokEPSS %71

    jenkins · credentials12 Nis 2022

  • CVE-2021-22797
    39İzleyin

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious scri

    YüksekCVSS 7,8İstismar yokEPSS %26

    schneider-electric · ecostruxure control expert13 Nis 2022

  • CVE-2022-22956
    54Planlayın

    VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

    KritikCVSS 9,8SilahlaştırılmışEPSS %49

    vmware · identity manager13 Nis 2022

  • CVE-2022-22957
    35İzleyin

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CV

    YüksekCVSS 7,2SilahlaştırılmışEPSS %23

    vmware · cloud foundation13 Nis 2022

  • CVE-2022-22960
    72Bu hafta

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissio

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %35

    vmware · cloud foundation13 Nis 2022

  • CVE-2022-24816
    100Hemen

    Improper Control of Generation of Code in jai-ext

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %99

    geosolutionsgroup · jai-ext13 Nis 2022

  • CVE-2021-43287
    38İzleyin

    An issue was discovered in ThoughtWorks GoCD before 21.3.0.

    YüksekCVSS 7,5Kavram kanıtıEPSS %27

    thoughtworks · gocd14 Nis 2022

  • CVE-2022-21145
    42Planlayın

    A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    OrtaCVSS 4,8İstismar yokEPSS %77

    lansweeper · lansweeper14 Nis 2022

  • CVE-2022-21210
    56Planlayın

    An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    YüksekCVSS 8,8İstismar yokEPSS %71

    lansweeper · lansweeper14 Nis 2022

  • CVE-2022-21234
    57Planlayın

    An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    YüksekCVSS 8,8İstismar yokEPSS %72

    lansweeper · lansweeper14 Nis 2022

  • CVE-2022-22149
    57Planlayın

    A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    YüksekCVSS 8,8İstismar yokEPSS %72

    lansweeper · lansweeper14 Nis 2022

  • CVE-2022-26498
    35İzleyin

    An issue was discovered in Asterisk through 19.x.

    YüksekCVSS 7,5İstismar yokEPSS %16

    digium · asterisk15 Nis 2022

  • CVE-2022-27474
    35İzleyin

    SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.

    YüksekCVSS 7,2İstismar yokEPSS %23

    salesagility · suitecrm15 Nis 2022

  • CVE-2022-20695
    46Planlayın

    Cisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability

    KritikCVSS 10,0İstismar yokEPSS %19

    cisco · wireless lan controller 8.10.151.015 Nis 2022

  • CVE-2022-24481
    36İzleyin

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %16

    microsoft · windows 1015 Nis 2022

  • CVE-2022-24491
    49Planlayın

    Windows Network File System Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %33

    microsoft · windows 1015 Nis 2022

  • CVE-2022-24497
    49Planlayın

    Windows Network File System Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    microsoft · windows 1015 Nis 2022

  • CVE-2022-24500
    46Planlayın

    Windows SMB Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %38

    microsoft · windows 1015 Nis 2022

  • CVE-2022-24521
    63Bu hafta

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %7

    microsoft · windows 10 150715 Nis 2022

  • CVE-2022-26809
    66Bu hafta

    Remote Procedure Call Runtime Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %90

    microsoft · windows 1015 Nis 2022

  • CVE-2022-26904
    63Bu hafta

    Windows User Profile Service Elevation of Privilege Vulnerability

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %16

    microsoft · windows 10 150715 Nis 2022

  • CVE-2022-27908
    46Planlayın

    Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.

    YüksekCVSS 8,8İstismar yokEPSS %36

    zohocorp · manageengine opmanager18 Nis 2022

  • CVE-2022-28810
    78Bu hafta

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS command

    OrtaCVSS 6,8KEVSilahlaştırılmışEPSS %70

    zohocorp · manageengine adselfservice plus18 Nis 2022

  • CVE-2020-35632
    36İzleyin

    Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.

    YüksekCVSS 8,8İstismar yokEPSS %2

    cgal · computational geometry algorithms library18 Nis 2022

  • CVE-2022-25226
    43Planlayın

    ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obta

    KritikCVSS 10,0Kavram kanıtıEPSS %10

    cybelsoft · thinvnc18 Nis 2022

  • CVE-2022-0661
    40Planlayın

    Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE

    YüksekCVSS 7,2İstismar yokEPSS %40

    ad injection project · ad injection18 Nis 2022

  • CVE-2022-1020
    47Planlayın

    Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    codeastrology · woo product table18 Nis 2022

  • CVE-2022-29464
    99Hemen

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    wso2 · api manager18 Nis 2022

  • CVE-2022-28108
    42Planlayın

    Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/f

    YüksekCVSS 8,8Kavram kanıtıEPSS %22

    selenium · selenium grid18 Nis 2022

  • CVE-2022-27927
    43Planlayın

    A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    microfinance management system project · microfinance management system19 Nis 2022

  • CVE-2022-1119
    36İzleyin

    Simple File List <= 3.2.7 - Arbitrary File Download

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    simplefilelist · simple-file-list19 Nis 2022

  • CVE-2022-1329
    63Bu hafta

    Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

    YüksekCVSS 8,8SilahlaştırılmışEPSS %92

    elementor · website builder19 Nis 2022

  • CVE-2022-21445
    88Hemen

    Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %62

    oracle · application development framework19 Nis 2022

  • CVE-2022-21449
    53Planlayın

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

    YüksekCVSS 7,5Kavram kanıtıEPSS %77

    oracle · graalvm19 Nis 2022

  • CVE-2022-21489
    49Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %78

    oracle · mysql19 Nis 2022

  • CVE-2022-21490
    49Planlayın

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    OrtaCVSS 6,3İstismar yokEPSS %78

    oracle · mysql cluster19 Nis 2022

  • CVE-2022-0540
    65Bu hafta

    A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP reques

    KritikCVSS 9,8Kavram kanıtıEPSS %88

    atlassian · jira data center20 Nis 2022

  • CVE-2022-26133
    60Bu hafta

    SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6

    KritikCVSS 9,8Kavram kanıtıEPSS %70

    atlassian · bitbucket data center20 Nis 2022

  • CVE-2022-27926
    59Planlayın

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allo

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %17

    synacor · zimbra collaboration suite20 Nis 2022

  • CVE-2022-29548
    36İzleyin

    A reflected XSS issue exists in the Management Console of several WSO2 products.

    OrtaCVSS 6,1Kavram kanıtıEPSS %41

    wso2 · api manager20 Nis 2022

  • CVE-2022-27924
    88Hemen

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %93

    synacor · zimbra collaboration suite21 Nis 2022

  • CVE-2022-27925
    88Hemen

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %98

    synacor · zimbra collaboration suite21 Nis 2022

  • CVE-2022-27478
    41Planlayın

    Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.

    YüksekCVSS 8,8İstismar yokEPSS %20

    victor cms project · victor cms21 Nis 2022

  • CVE-2022-28021
    46Planlayın

    Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=

    KritikCVSS 9,8İstismar yokEPSS %24

    purchase order management system project · purchase order management system21 Nis 2022

  • CVE-2022-1429
    49Planlayın

    SQL injection in GridHelperService.php in pimcore/pimcore

    YüksekCVSS 7,5İstismar yokEPSS %63

    pimcore · pimcore22 Nis 2022

  • CVE-2021-45837
    44Planlayın

    It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically c

    KritikCVSS 9,8SilahlaştırılmışEPSS %16

    terra-master · tos25 Nis 2022

  • CVE-2021-45839
    29İzleyin

    It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as

    OrtaCVSS 6,5SilahlaştırılmışEPSS %9

    terra-master · tos25 Nis 2022

  • CVE-2021-45841
    35İzleyin

    In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address a

    YüksekCVSS 8,1SilahlaştırılmışEPSS %8

    terra-master · tos25 Nis 2022

  • CVE-2022-29078
    49Planlayın

    The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][output

    KritikCVSS 9,8Kavram kanıtıEPSS %32

    ejs · ejs25 Nis 2022

  • CVE-2021-25094
    57Planlayın

    Tatsu < 3.3.12 - Unauthenticated RCE

    YüksekCVSS 8,1SilahlaştırılmışEPSS %83

    brandexponents · tatsu25 Nis 2022

  • CVE-2022-1390
    46Planlayın

    Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    admin word count column project · admin word count column25 Nis 2022

  • CVE-2022-1391
    44Planlayın

    Cab fare calculator < 1.0.4 - Unauthenticated LFI

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    kanev · cab fare calculator25 Nis 2022

  • CVE-2022-1392
    33İzleyin

    Videos sync PDF <= 1.7.4 - Unauthenticated LFI

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    commoninja · videos sync pdf25 Nis 2022

  • CVE-2021-35250
    34İzleyin

    Directory Transversal Vulnerability in Serv-U 15.3

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    solarwinds · serv-u25 Nis 2022

  • CVE-2022-29499
    86Hemen

    The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %55

    mitel · mivoice connect25 Nis 2022

  • CVE-2022-29806
    59Planlayın

    ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

    KritikCVSS 9,8SilahlaştırılmışEPSS %67

    zoneminder · zoneminder26 Nis 2022

  • CVE-2022-24706
    97Hemen

    Remote Code Execution Vulnerability in Packaging

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %92

    apache · couchdb26 Nis 2022

  • CVE-2021-46441
    45Planlayın

    In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute ar

    YüksekCVSS 8,8İstismar yokEPSS %32

    dlink · dir-825 firmware27 Nis 2022

  • CVE-2021-46442
    56Planlayın

    In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions

    KritikCVSS 9,8İstismar yokEPSS %56

    dlink · dir-825 firmware27 Nis 2022

  • CVE-2021-46422
    67Bu hafta

    Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without

    KritikCVSS 9,8Kavram kanıtıEPSS %94

    telesquare · sdt-cs3b1 firmware27 Nis 2022

  • CVE-2021-46424
    47Planlayın

    Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even

    KritikCVSS 9,1Kavram kanıtıEPSS %36

    telesquare · tlr-2005ksh firmware27 Nis 2022

  • CVE-2022-27336
    45Planlayın

    Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.

    KritikCVSS 9,8İstismar yokEPSS %20

    seacms · seacms27 Nis 2022

  • CVE-2022-24735
    32İzleyin

    Lua scripts can be manipulated to overcome ACL rules in Redis

    YüksekCVSS 7,8İstismar yokEPSS %2

    redis · redis27 Nis 2022

  • CVE-2022-28117
    26İzleyin

    A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make ar

    OrtaCVSS 4,9Kavram kanıtıEPSS %22

    naviwebs · navigate cms28 Nis 2022

  • CVE-2022-29081
    64Bu hafta

    Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-contro

    KritikCVSS 9,8Kavram kanıtıEPSS %83

    zohocorp · manageengine access manager plus28 Nis 2022

  • CVE-2022-29904
    44Planlayın

    The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with cer

    KritikCVSS 9,8İstismar yokEPSS %16

    mediawiki · mediawiki29 Nis 2022