İçeriğe atla
Noroxi

Yayın tarihine göre

Ağustos 2022: sömürülen ve yeni ciddi CVE kayıtları

82 kayıt · 8 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-36799
    42Planlayın

    This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented.

    YüksekCVSS 7,2İstismar yokEPSS %46

    atlassian · jira data center1 Ağu 2022

  • CVE-2022-27255
    50Planlayın

    In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow.

    KritikCVSS 9,8Kavram kanıtıEPSS %36

    realtek · ecos rsdk firmware1 Ağu 2022

  • CVE-2022-31188
    53Planlayın

    Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

    KritikCVSS 9,8Kavram kanıtıEPSS %48

    cvat · computer vision annotation tool1 Ağu 2022

  • CVE-2022-35919
    26İzleyin

    Authenticated requests for server update admin API allows path traversal in minio

    DüşükCVSS 2,7Kavram kanıtıEPSS %52

    minio · minio1 Ağu 2022

  • CVE-2022-35737
    37İzleyin

    SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    sqlite · sqlite3 Ağu 2022

  • CVE-2022-34973
    35İzleyin

    D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp.

    YüksekCVSS 7,5İstismar yokEPSS %15

    dlink · dir-820l firmware3 Ağu 2022

  • CVE-2022-34974
    46Planlayın

    D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function.

    KritikCVSS 9,8İstismar yokEPSS %24

    dlink · dir-810l firmware3 Ağu 2022

  • CVE-2022-35620
    49Planlayın

    D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi_m

    KritikCVSS 9,8İstismar yokEPSS %32

    dlink · dir-818l firmware3 Ağu 2022

  • CVE-2022-27166
    50Planlayın

    XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2

    OrtaCVSS 6,1İstismar yokEPSS %86

    apache · jspwiki4 Ağu 2022

  • CVE-2022-28730
    50Planlayın

    Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

    OrtaCVSS 6,1İstismar yokEPSS %86

    apache · jspwiki4 Ağu 2022

  • CVE-2022-28731
    44Planlayın

    Apache JSPWiki CSRF in UserPreferences.jsp

    OrtaCVSS 6,5İstismar yokEPSS %58

    apache · jspwiki4 Ağu 2022

  • CVE-2022-28732
    49Planlayın

    Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin

    OrtaCVSS 6,1İstismar yokEPSS %82

    apache · jspwiki4 Ağu 2022

  • CVE-2022-2651
    44Planlayın

    Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    joinbookwyrm · bookwyrm4 Ağu 2022

  • CVE-2022-31793
    35İzleyin

    do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single characte

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    inglorion · muhttpd4 Ağu 2022

  • CVE-2022-21186
    47Planlayın

    Arbitrary Command Injection

    KritikCVSS 9,8İstismar yokEPSS %26

    acrontum · filesystem-template5 Ağu 2022

  • CVE-2022-37434
    45Planlayın

    zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    zlib · zlib5 Ağu 2022

  • CVE-2022-31656
    46Planlayın

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    vmware · identity manager5 Ağu 2022

  • CVE-2022-31660
    40Planlayın

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %1

    vmware · identity manager5 Ağu 2022

  • CVE-2022-36267
    55Planlayın

    In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %54

    airspan · airspot 5410 firmware8 Ağu 2022

  • CVE-2022-2733
    53Planlayın

    Cross-site Scripting (XSS) - Reflected in openemr/openemr

    OrtaCVSS 6,1Kavram kanıtıEPSS %95

    open-emr · openemr9 Ağu 2022

  • CVE-2022-34713
    81Hemen

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %67

    microsoft · windows 10 15079 Ağu 2022

  • CVE-2022-34715
    63Bu hafta

    Windows Network File System Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %80

    microsoft · windows server 20229 Ağu 2022

  • CVE-2022-36801
    44Planlayın

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref

    OrtaCVSS 6,1İstismar yokEPSS %66

    atlassian · jira data center9 Ağu 2022

  • CVE-2022-0028
    65Bu hafta

    PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %2

    paloaltonetworks · pan-os10 Ağu 2022

  • CVE-2022-20866
    35İzleyin

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software RSA Private Key Leak Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    cisco · adaptive security appliance software10 Ağu 2022

  • CVE-2022-23238
    26İzleyin

    Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less

    OrtaCVSS 6,5İstismar yokEPSS %0

    linux · linux kernel10 Ağu 2022

  • CVE-2022-32429
    62Bu hafta

    An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MN

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    megatech · msnswitch firmware10 Ağu 2022

  • CVE-2022-37024
    59Planlayın

    Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 t

    YüksekCVSS 8,8İstismar yokEPSS %79

    zohocorp · manageengine firewall analyzer10 Ağu 2022

  • CVE-2022-38129
    45Planlayın

    A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor M

    KritikCVSS 9,8İstismar yokEPSS %21

    keysight · sensor management server10 Ağu 2022

  • CVE-2022-38130
    55Planlayın

    The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS.

    KritikCVSS 9,8Kavram kanıtıEPSS %54

    keysight · sensor management server10 Ağu 2022

  • CVE-2022-35555
    47Planlayın

    A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput para

    KritikCVSS 9,8İstismar yokEPSS %26

    tenda · w6 firmware12 Ağu 2022

  • CVE-2022-35559
    43Planlayın

    A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 paramet

    KritikCVSS 9,8İstismar yokEPSS %11

    tenda · w6 firmware12 Ağu 2022

  • CVE-2022-37042
    97Hemen

    Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91

    synacor · zimbra collaboration suite12 Ağu 2022

  • CVE-2022-2314
    44Planlayın

    VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    vr calendar project · vr calendar15 Ağu 2022

  • CVE-2022-36309
    42Planlayın

    Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of

    YüksekCVSS 8,8İstismar yokEPSS %24

    airspan · airvelocity 1500 firmware15 Ağu 2022

  • CVE-2022-37393
    40Planlayın

    Zimbra zmslapd arbitrary module load

    YüksekCVSS 7,8SilahlaştırılmışEPSS %1

    zimbra · collaboration16 Ağu 2022

  • CVE-2020-14321
    40Planlayın

    In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %16

    moodle · moodle16 Ağu 2022

  • CVE-2022-34258
    40Planlayın

    Adobe Commerce Stored XSS Arbitrary code execution

    OrtaCVSS 4,8İstismar yokEPSS %69

    adobe · commerce16 Ağu 2022

  • CVE-2022-1401
    36İzleyin

    Insufficient validation of provided paths in Exago WrImageResource.axd

    YüksekCVSS 7,5İstismar yokEPSS %18

    device42 · cmdb16 Ağu 2022

  • CVE-2022-1373
    40Planlayın

    Softing Secure Integration Server Relative Path Traversal

    YüksekCVSS 7,2SilahlaştırılmışEPSS %12

    softing · edgeaggregator17 Ağu 2022

  • CVE-2022-23747
    42Planlayın

    In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed

    KritikCVSS 9,8İstismar yokEPSS %10

    sony · xperia 1 firmware17 Ağu 2022

  • CVE-2022-2334
    40Planlayın

    Softing Secure Integration Server Uncontrolled Search Path Element

    YüksekCVSS 7,2SilahlaştırılmışEPSS %12

    softing · edgeaggregator17 Ağu 2022

  • CVE-2022-37060
    36İzleyin

    FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restricti

    YüksekCVSS 7,5İstismar yokEPSS %18

    flir · flir ax8 firmware18 Ağu 2022

  • CVE-2022-37061
    69Bu hafta

    All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection.

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    flir · flir ax8 firmware18 Ağu 2022

  • CVE-2022-29805
    47Planlayın

    A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitra

    KritikCVSS 9,8İstismar yokEPSS %27

    fishbowlinventory · fishbowl19 Ağu 2022

  • CVE-2022-2551
    35İzleyin

    Duplicator < 1.4.7 - Unauthenticated Backup Download

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    awesomemotive · duplicator22 Ağu 2022

  • CVE-2022-2552
    25İzleyin

    Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure

    OrtaCVSS 5,3Kavram kanıtıEPSS %12

    awesomemotive · duplicator22 Ağu 2022

  • CVE-2022-37134
    46Planlayın

    D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi.

    KritikCVSS 9,8İstismar yokEPSS %21

    dlink · dir-816 firmware22 Ağu 2022

  • CVE-2022-35583
    44Planlayın

    wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag wit

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    wkhtmltopdf · wkhtmltopdf22 Ağu 2022

  • CVE-2022-30534
    57Planlayın

    An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

    YüksekCVSS 8,8İstismar yokEPSS %74

    wwbn · avideo22 Ağu 2022

  • CVE-2022-30547
    58Planlayın

    A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

    KritikCVSS 9,9İstismar yokEPSS %63

    wwbn · avideo22 Ağu 2022

  • CVE-2022-30690
    49Planlayın

    A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

    OrtaCVSS 6,1İstismar yokEPSS %83

    wwbn · avideo22 Ağu 2022

  • CVE-2022-32572
    42Planlayın

    An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

    YüksekCVSS 8,8İstismar yokEPSS %24

    wwbn · avideo22 Ağu 2022

  • CVE-2021-42627
    58Planlayın

    The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    dlink · dir-615 firmware23 Ağu 2022

  • CVE-2022-37113
    44Planlayın

    Bluecms 1.6 has SQL injection in line 132 of admin/area.php

    KritikCVSS 9,8İstismar yokEPSS %15

    bluecms project · bluecms23 Ağu 2022

  • CVE-2022-36633
    50Planlayın

    Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution.

    YüksekCVSS 8,8Kavram kanıtıEPSS %50

    goteleport · teleport24 Ağu 2022

  • CVE-2022-2234
    48Planlayın

    mySCADA myPRO Command Injection

    YüksekCVSS 8,8İstismar yokEPSS %43

    myscada · mypro24 Ağu 2022

  • CVE-2022-32893
    68Bu hafta

    An out-of-bounds write issue was addressed with improved bounds checking.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %9

    apple · safari24 Ağu 2022

  • CVE-2022-32894
    62Bu hafta

    An out-of-bounds write issue was addressed with improved bounds checking.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    apple · ipados24 Ağu 2022

  • CVE-2022-36804
    95Hemen

    Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    atlassian · bitbucket25 Ağu 2022

  • CVE-2022-36509
    34İzleyin

    H3C GR3200 MiniGR1B0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

    YüksekCVSS 7,8İstismar yokEPSS %10

    h3c · gr3200 firmware25 Ağu 2022

  • CVE-2022-36510
    34İzleyin

    H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

    YüksekCVSS 7,8İstismar yokEPSS %10

    h3c · gr2200 firmware25 Ağu 2022

  • CVE-2022-37070
    42Planlayın

    H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

    KritikCVSS 9,8İstismar yokEPSS %10

    h3c · gr-1200w firmware25 Ağu 2022

  • CVE-2022-37159
    47Planlayın

    Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.

    KritikCVSS 9,8İstismar yokEPSS %27

    claroline · claroline25 Ağu 2022

  • CVE-2022-31499
    58Planlayın

    Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo.

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    nortekcontrol · emerge e3 firmware25 Ağu 2022

  • CVE-2022-36537
    89Hemen

    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %95

    zkoss · zk framework26 Ağu 2022

  • CVE-2022-37057
    47Planlayın

    D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main.

    KritikCVSS 9,8İstismar yokEPSS %25

    dlink · go-rt-ac750 firmware28 Ağu 2022

  • CVE-2022-37055
    86Hemen

    D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %55

    dlink · go-rt-ac750 firmware28 Ağu 2022

  • CVE-2022-37056
    42Planlayın

    D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,

    KritikCVSS 9,8İstismar yokEPSS %11

    dlink · go-rt-ac750 firmware28 Ağu 2022

  • CVE-2022-38555
    42Planlayın

    Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.

    KritikCVSS 9,8İstismar yokEPSS %10

    linksys · e1200 firmware28 Ağu 2022

  • CVE-2022-36572
    46Planlayın

    Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /up

    KritikCVSS 9,8İstismar yokEPSS %23

    sinsiu · enterprise website system28 Ağu 2022

  • CVE-2022-34668
    42Planlayın

    NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivile

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    nvidia · nvflare28 Ağu 2022

  • CVE-2022-22897
    43Planlayın

    A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    apollotheme · ap pagebuilder29 Ağu 2022

  • CVE-2022-32548
    49Planlayın

    An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1.

    KritikCVSS 9,8Kavram kanıtıEPSS %33

    draytek · vigor3910 firmware29 Ağu 2022

  • CVE-2022-1043
    40Planlayın

    A flaw was found in the Linux kernel’s io_uring implementation.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %3

    linux · linux kernel29 Ağu 2022

  • CVE-2022-38772
    58Planlayın

    Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 1260

    YüksekCVSS 8,8İstismar yokEPSS %78

    zohocorp · manageengine netflow analyzer29 Ağu 2022

  • CVE-2022-36553
    66Bu hafta

    Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi

    KritikCVSS 9,8Kavram kanıtıEPSS %90

    hytec · hwl-2511-ss firmware29 Ağu 2022

  • CVE-2022-1552
    40Planlayın

    A flaw was found in PostgreSQL.

    YüksekCVSS 8,8İstismar yokEPSS %15

    postgresql · postgresql31 Ağu 2022

  • CVE-2022-37122
    37İzleyin

    Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unaut

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    carel · pcoweb card firmware31 Ağu 2022

  • CVE-2022-37128
    46Planlayın

    In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.

    KritikCVSS 9,8İstismar yokEPSS %21

    dlink · dir-816 firmware31 Ağu 2022

  • CVE-2022-36620
    37İzleyin

    D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.

    YüksekCVSS 7,5İstismar yokEPSS %23

    dlink · dir-816 firmware31 Ağu 2022

  • CVE-2022-37130
    47Planlayın

    In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the cond

    KritikCVSS 9,8İstismar yokEPSS %26

    dlink · dir-816 firmware31 Ağu 2022