İçeriğe atla
Noroxi

Yayın tarihine göre

Haziran 2022: sömürülen ve yeni ciddi CVE kayıtları

75 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-30190
    91Hemen

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %99

    microsoft · windows 10 15071 Haz 2022

  • CVE-2021-44080
    35İzleyin

    A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators t

    YüksekCVSS 7,2İstismar yokEPSS %24

    sercomm · h500s firmware2 Haz 2022

  • CVE-2022-1660
    44Planlayın

    Keysight N6854A Geolocation server and N6841A RF Sensor software

    KritikCVSS 9,8İstismar yokEPSS %16

    keysight · n6854a firmware2 Haz 2022

  • CVE-2022-1661
    35İzleyin

    Keysight N6854A Geolocation server and N6841A RF Sensor software

    YüksekCVSS 7,5İstismar yokEPSS %15

    keysight · n6854a firmware2 Haz 2022

  • CVE-2022-25237
    56Planlayın

    Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the Rest

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    bonitasoft · bonita web2 Haz 2022

  • CVE-2022-28799
    40Planlayın

    The TikTok application before 23.7.3 for Android allows account takeover.

    YüksekCVSS 8,8İstismar yokEPSS %16

    tiktok · tiktok2 Haz 2022

  • CVE-2022-30425
    41Planlayın

    Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr paramet

    YüksekCVSS 8,8İstismar yokEPSS %19

    tenda · hg6 firmware2 Haz 2022

  • CVE-2022-30521
    44Planlayın

    The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA

    KritikCVSS 9,8İstismar yokEPSS %15

    dlink · dir-890l firmware2 Haz 2022

  • CVE-2022-30808
    44Planlayın

    elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.

    KritikCVSS 9,8İstismar yokEPSS %17

    elitecms · elite cms2 Haz 2022

  • CVE-2021-42887
    52Planlayın

    In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

    KritikCVSS 9,8Kavram kanıtıEPSS %44

    totolink · ex1200t firmware3 Haz 2022

  • CVE-2022-26134
    99Hemen

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    atlassian · confluence data center3 Haz 2022

  • CVE-2022-30860
    35İzleyin

    FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.

    YüksekCVSS 7,2İstismar yokEPSS %24

    fudforum · fudforum6 Haz 2022

  • CVE-2022-1680
    40Planlayın

    An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting f

    YüksekCVSS 8,8İstismar yokEPSS %15

    gitlab · gitlab6 Haz 2022

  • CVE-2021-37589
    40Planlayın

    Virtua Cobranca before 12R allows SQL Injection on the login page.

    YüksekCVSS 7,5Kavram kanıtıEPSS %32

    virtuasoftware · cobranca7 Haz 2022

  • CVE-2022-31470
    40Planlayın

    An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 1

    OrtaCVSS 6,1Kavram kanıtıEPSS %52

    axigen · axigen mobile webmail7 Haz 2022

  • CVE-2022-1703
    39İzleyin

    Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attack

    YüksekCVSS 8,8İstismar yokEPSS %12

    sonicwall · sma 210 firmware8 Haz 2022

  • CVE-2022-1692
    42Planlayın

    CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    dwbooster · cp image store with slideshow8 Haz 2022

  • CVE-2022-29013
    62Bu hafta

    A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands

    KritikCVSS 9,8Kavram kanıtıEPSS %77

    razer · sila firmware8 Haz 2022

  • CVE-2022-29014
    34İzleyin

    A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    razer · sila firmware8 Haz 2022

  • CVE-2022-30075
    45Planlayın

    In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due

    YüksekCVSS 8,8Kavram kanıtıEPSS %34

    tp-link · archer ax50 firmware9 Haz 2022

  • CVE-2022-31827
    43Planlayın

    MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.

    KritikCVSS 9,1İstismar yokEPSS %21

    monstaftp · monstaftp9 Haz 2022

  • CVE-2022-31830
    41Planlayın

    Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.

    KritikCVSS 9,1İstismar yokEPSS %16

    baidu · kity minder9 Haz 2022

  • CVE-2019-25065
    60Bu hafta

    OpenNetAdmin os command injection

    KritikCVSS 9,8SilahlaştırılmışEPSS %6

    opennetadmin · opennetadmin9 Haz 2022

  • CVE-2019-25066
    40Planlayın

    ajenti API privileges management

    YüksekCVSS 8,8SilahlaştırılmışEPSS %5

    ajenti · ajenti9 Haz 2022

  • CVE-2022-1993
    43Planlayın

    Path Traversal in gogs/gogs

    YüksekCVSS 8,1İstismar yokEPSS %36

    gogs · gogs9 Haz 2022

  • CVE-2022-26377
    36İzleyin

    mod_proxy_ajp: Possible request smuggling

    YüksekCVSS 7,5Kavram kanıtıEPSS %21

    apache · http server9 Haz 2022

  • CVE-2022-30522
    57Planlayın

    mod_sed denial of service

    YüksekCVSS 7,5İstismar yokEPSS %89

    apache · http server9 Haz 2022

  • CVE-2017-20029
    45Planlayın

    PHPList Edit Subscription index.php sql injection

    KritikCVSS 9,8İstismar yokEPSS %21

    phplist · phplist10 Haz 2022

  • CVE-2022-31788
    43Planlayın

    IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.

    KritikCVSS 9,8İstismar yokEPSS %14

    ideaco · idealms10 Haz 2022

  • CVE-2022-25845
    45Planlayın

    Deserialization of Untrusted Data

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    alibaba · fastjson10 Haz 2022

  • CVE-2022-30780
    47Planlayın

    Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connec

    YüksekCVSS 7,5Kavram kanıtıEPSS %57

    lighttpd · lighttpd11 Haz 2022

  • CVE-2021-41749
    44Planlayın

    In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injectio

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    nystudio107 · seomatic12 Haz 2022

  • CVE-2022-0786
    43Planlayın

    KiviCare < 2.3.9 - Unauthenticated SQLi

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    iqonic · kivicare13 Haz 2022

  • CVE-2022-0863
    35İzleyin

    WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)

    YüksekCVSS 7,2İstismar yokEPSS %23

    wp svg icons project · wp svg icons13 Haz 2022

  • CVE-2022-1707
    51Planlayın

    Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search

    OrtaCVSS 6,1İstismar yokEPSS %89

    gtm4wp · google tag manager13 Haz 2022

  • CVE-2022-1768
    34İzleyin

    RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    carrcommunications · rsvpmaker13 Haz 2022

  • CVE-2022-29455
    31İzleyin

    WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %23

    elementor · website builder13 Haz 2022

  • CVE-2022-33174
    34İzleyin

    Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interfa

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    powertekpdus · basic pdu firmware13 Haz 2022

  • CVE-2022-31446
    49Planlayın

    Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter

    KritikCVSS 9,8İstismar yokEPSS %34

    tendacn · ac18 firmware13 Haz 2022

  • CVE-2022-22071
    61Bu hafta

    Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon A

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    qualcomm · apq8053 firmware14 Haz 2022

  • CVE-2022-29034
    33İzleyin

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1).

    OrtaCVSS 6,1İstismar yokEPSS %28

    siemens · sinema remote connect server14 Haz 2022

  • CVE-2022-2086
    41Planlayın

    SourceCodester Bank Management System login.php sql injection

    YüksekCVSS 8,8İstismar yokEPSS %19

    bank management system project · bank management system15 Haz 2022

  • CVE-2022-24436
    30İzleyin

    Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable info

    OrtaCVSS 6,5İstismar yokEPSS %12

    intel · *15 Haz 2022

  • CVE-2021-41403
    45Planlayın

    flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.

    KritikCVSS 9,8İstismar yokEPSS %19

    flatcore · flatcore-cms15 Haz 2022

  • CVE-2022-30136
    61Bu hafta

    Windows Network File System Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %72

    microsoft · windows server 201215 Haz 2022

  • CVE-2022-31626
    52Planlayın

    mysqlnd/pdo password buffer overflow

    YüksekCVSS 8,8Kavram kanıtıEPSS %58

    php · php16 Haz 2022

  • CVE-2022-30023
    47Planlayın

    Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.

    YüksekCVSS 8,8Kavram kanıtıEPSS %39

    tenda · hg9 firmware16 Haz 2022

  • CVE-2022-24562
    55Planlayın

    In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access t

    KritikCVSS 9,8Kavram kanıtıEPSS %54

    iobit · iotransfer16 Haz 2022

  • CVE-2022-27511
    36İzleyin

    Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password

    YüksekCVSS 8,1İstismar yokEPSS %12

    citrix · application delivery management16 Haz 2022

  • CVE-2022-31874
    45Planlayın

    ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface.

    KritikCVSS 9,8İstismar yokEPSS %19

    asus · rt-n53 firmware17 Haz 2022

  • CVE-2022-1905
    50Planlayın

    Events Made Easy < 2.2.81 - Unauthenticated SQLi

    KritikCVSS 9,8İstismar yokEPSS %37

    e-dynamics · events made easy20 Haz 2022

  • CVE-2022-25772
    43Planlayın

    A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable

    OrtaCVSS 6,1İstismar yokEPSS %63

    acquia · mautic20 Haz 2022

  • CVE-2022-29775
    57Planlayın

    iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

    KritikCVSS 9,8Kavram kanıtıEPSS %61

    ispyconnect · ispy21 Haz 2022

  • CVE-2022-2068
    58Planlayın

    The c_rehash script allows command injection

    YüksekCVSS 7,3İstismar yokEPSS %96

    openssl · openssl21 Haz 2022

  • CVE-2022-22980
    44Planlayın

    A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expres

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    vmware · spring data mongodb23 Haz 2022

  • CVE-2022-31362
    40Planlayın

    Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability.

    YüksekCVSS 8,8İstismar yokEPSS %18

    docebo · docebo23 Haz 2022

  • CVE-2022-34176
    44Planlayın

    Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site script

    OrtaCVSS 5,4İstismar yokEPSS %77

    jenkins · junit23 Haz 2022

  • CVE-2013-1916
    39İzleyin

    In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on th

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    user photo project · user photo24 Haz 2022

  • CVE-2022-32209
    33İzleyin

    # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sani

    OrtaCVSS 6,1İstismar yokEPSS %30

    rubyonrails · rails html sanitizers24 Haz 2022

  • CVE-2022-20828
    43Planlayın

    Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability

    YüksekCVSS 7,2SilahlaştırılmışEPSS %49

    cisco · asa firepower24 Haz 2022

  • CVE-2022-1574
    43Planlayın

    HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    html2wp project · html2wp27 Haz 2022

  • CVE-2022-28171
    54Planlayın

    The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %51

    hikvision · ds-a71024 firmware27 Haz 2022

  • CVE-2022-31101
    42Planlayın

    SQL Injection in prestashop/blockwishlist

    YüksekCVSS 8,8Kavram kanıtıEPSS %23

    prestashop · blockwishlist27 Haz 2022

  • CVE-2022-32994
    45Planlayın

    Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.

    KritikCVSS 9,8İstismar yokEPSS %18

    halo · halo27 Haz 2022

  • CVE-2022-32995
    44Planlayın

    Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.

    KritikCVSS 9,8İstismar yokEPSS %17

    halo · halo27 Haz 2022

  • CVE-2022-31056
    42Planlayın

    SQL injection with _actor parameter in GLPI

    KritikCVSS 9,8Kavram kanıtıEPSS %9

    glpi-project · glpi28 Haz 2022

  • CVE-2022-31061
    54Planlayın

    SQL injection on login page in GLPI

    KritikCVSS 9,8Kavram kanıtıEPSS %51

    glpi-project · glpi28 Haz 2022

  • CVE-2022-31885
    49Planlayın

    Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.

    KritikCVSS 9,8Kavram kanıtıEPSS %32

    marvalglobal · marval msm28 Haz 2022

  • CVE-2022-32532
    47Planlayın

    Authentication Bypass Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    apache · shiro28 Haz 2022

  • CVE-2022-33107
    46Planlayın

    ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Stor

    KritikCVSS 9,8İstismar yokEPSS %23

    thinkphp · thinkphp29 Haz 2022

  • CVE-2022-2073
    31İzleyin

    Code Injection in getgrav/grav

    YüksekCVSS 7,2İstismar yokEPSS %10

    getgrav · grav29 Haz 2022

  • CVE-2022-26135
    47Planlayın

    A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the si

    OrtaCVSS 6,5Kavram kanıtıEPSS %71

    atlassian · jira data center30 Haz 2022

  • CVE-2022-34777
    43Planlayın

    Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resultin

    OrtaCVSS 5,4İstismar yokEPSS %73

    jenkins · gitlab30 Haz 2022

  • CVE-2022-34783
    45Planlayın

    Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exp

    OrtaCVSS 5,4İstismar yokEPSS %81

    jenkins · plot30 Haz 2022

  • CVE-2022-28127
    47Planlayın

    A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0.

    KritikCVSS 9,1İstismar yokEPSS %37

    robustel · r1510 firmware30 Haz 2022