İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2022: sömürülen ve yeni ciddi CVE kayıtları

75 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-25813
    50Planlayın

    Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz

    YüksekCVSS 7,5Kavram kanıtıEPSS %67

    apache · ofbiz2 Eyl 2022

  • CVE-2022-36642
    43Planlayın

    A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to acc

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    telosalliance · omnia mpx node firmware2 Eyl 2022

  • CVE-2022-31814
    67Bu hafta

    pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP H

    KritikCVSS 9,8SilahlaştırılmışEPSS %91

    netgate · pfblockerng5 Eyl 2022

  • CVE-2022-2633
    42Planlayın

    The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'd

    YüksekCVSS 8,2Kavram kanıtıEPSS %33

    plugins360 · all-in-one video gallery6 Eyl 2022

  • CVE-2022-36067
    54Planlayın

    vm2 vulnerable to Sandbox Escape before v3.9.11

    KritikCVSS 10,0Kavram kanıtıEPSS %47

    vm2 project · vm26 Eyl 2022

  • CVE-2021-36782
    40Planlayın

    Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object

    KritikCVSS 9,9SilahlaştırılmışEPSS %4

    suse · rancher7 Eyl 2022

  • CVE-2022-27593
    92Hemen

    An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station.

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %87

    qnap · photo station8 Eyl 2022

  • CVE-2022-30079
    43Planlayın

    Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that cou

    YüksekCVSS 8,8İstismar yokEPSS %25

    netgear · r62008 Eyl 2022

  • CVE-2022-36094
    55Planlayın

    XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

    KritikCVSS 9,0İstismar yokEPSS %64

    xwiki · xwiki8 Eyl 2022

  • CVE-2022-36096
    54Planlayın

    XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

    KritikCVSS 9,0İstismar yokEPSS %60

    xwiki · xwiki8 Eyl 2022

  • CVE-2022-36097
    41Planlayın

    XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

    OrtaCVSS 6,1İstismar yokEPSS %58

    xwiki · xwiki8 Eyl 2022

  • CVE-2022-36098
    57Planlayın

    XWiki Platform Mentions UI vulnerable to Cross-site Scripting

    KritikCVSS 9,0İstismar yokEPSS %71

    xwiki · xwiki8 Eyl 2022

  • CVE-2022-36099
    58Planlayın

    XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %76

    xwiki · xwiki8 Eyl 2022

  • CVE-2022-36100
    57Planlayın

    XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

    YüksekCVSS 8,8İstismar yokEPSS %73

    xwiki · xwiki8 Eyl 2022

  • CVE-2022-25765
    51Planlayın

    The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

    KritikCVSS 9,8Kavram kanıtıEPSS %41

    pdfkit project · pdfkit9 Eyl 2022

  • CVE-2022-39810
    41Planlayın

    An issue was discovered in WSO2 Enterprise Integrator 6.4.0.

    OrtaCVSS 6,1İstismar yokEPSS %57

    wso2 · enterprise integrator9 Eyl 2022

  • CVE-2022-37860
    63Bu hafta

    The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection v

    KritikCVSS 9,8İstismar yokEPSS %80

    tp-link · m7350 firmware12 Eyl 2022

  • CVE-2022-33679
    35İzleyin

    Windows Kerberos Elevation of Privilege Vulnerability

    YüksekCVSS 8,1Kavram kanıtıEPSS %11

    microsoft · windows server 200813 Eyl 2022

  • CVE-2022-34718
    55Planlayın

    Windows TCP/IP Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %54

    microsoft · windows 1013 Eyl 2022

  • CVE-2022-34721
    62Bu hafta

    Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %76

    microsoft · windows 1013 Eyl 2022

  • CVE-2022-34729
    34İzleyin

    Windows GDI Elevation of Privilege Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %10

    microsoft · windows 1013 Eyl 2022

  • CVE-2022-35803
    38İzleyin

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %23

    microsoft · windows 1013 Eyl 2022

  • CVE-2022-35823
    51Planlayın

    Microsoft SharePoint Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %53

    microsoft · sharepoint enterprise server13 Eyl 2022

  • CVE-2022-37954
    44Planlayın

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %44

    microsoft · windows 1013 Eyl 2022

  • CVE-2022-37957
    35İzleyin

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %13

    microsoft · windows 1013 Eyl 2022

  • CVE-2022-37958
    58Planlayın

    SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %86

    microsoft · windows 1013 Eyl 2022

  • CVE-2022-37961
    50Planlayın

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %50

    microsoft · sharepoint enterprise server13 Eyl 2022

  • CVE-2022-37969
    69Bu hafta

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %28

    microsoft · windows 10 150713 Eyl 2022

  • CVE-2022-35413
    44Planlayın

    WAPPLES through 6.0 has a hardcoded systemi account.

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    pentasecurity · wapples13 Eyl 2022

  • CVE-2022-37190
    49Planlayın

    CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE).

    YüksekCVSS 8,8Kavram kanıtıEPSS %45

    cuppacms · cuppacms13 Eyl 2022

  • CVE-2022-36667
    42Planlayın

    Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function.

    YüksekCVSS 8,8İstismar yokEPSS %24

    garage management system project · garage management system14 Eyl 2022

  • CVE-2022-37661
    49Planlayın

    SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature.

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    adtran · sr510n firmware14 Eyl 2022

  • CVE-2022-38308
    45Planlayın

    TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cst

    KritikCVSS 9,8İstismar yokEPSS %21

    totolink · a7000ru firmware14 Eyl 2022

  • CVE-2022-38352
    45Planlayın

    ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.

    KritikCVSS 9,8İstismar yokEPSS %21

    thinkphp · thinkphp14 Eyl 2022

  • CVE-2022-36532
    42Planlayın

    Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload an

    YüksekCVSS 8,8Kavram kanıtıEPSS %24

    bolt · bolt cms15 Eyl 2022

  • CVE-2022-36533
    34İzleyin

    Super Flexible Software GmbH & Co.

    OrtaCVSS 5,4İstismar yokEPSS %42

    syncovery · syncovery15 Eyl 2022

  • CVE-2022-36534
    51Planlayın

    Super Flexible Software GmbH & Co.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %52

    syncovery · syncovery15 Eyl 2022

  • CVE-2022-36536
    40Planlayın

    An issue in the component post_applogin.php of Super Flexible Software GmbH & Co.

    KritikCVSS 9,8SilahlaştırılmışEPSS %4

    syncovery · syncovery15 Eyl 2022

  • CVE-2022-2863
    27İzleyin

    WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read

    OrtaCVSS 4,9Kavram kanıtıEPSS %25

    wpvivid · migration\, backup\, staging16 Eyl 2022

  • CVE-2022-40152
    36İzleyin

    Stack Buffer Overflow in Woodstox

    YüksekCVSS 7,5İstismar yokEPSS %18

    xstream · xstream16 Eyl 2022

  • CVE-2022-38827
    43Planlayın

    TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi

    KritikCVSS 9,8İstismar yokEPSS %12

    totolink · t6 firmware16 Eyl 2022

  • CVE-2022-38828
    45Planlayın

    TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi

    KritikCVSS 9,8İstismar yokEPSS %20

    totolink · t6 firmware16 Eyl 2022

  • CVE-2022-38621
    47Planlayın

    Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page.

    KritikCVSS 9,8İstismar yokEPSS %25

    doufox · doufox16 Eyl 2022

  • CVE-2022-40300
    69Bu hafta

    Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 bef

    KritikCVSS 9,8İstismar yokEPSS %99

    zohocorp · manageengine access manager plus16 Eyl 2022

  • CVE-2022-39960
    29İzleyin

    The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks.

    OrtaCVSS 5,3Kavram kanıtıEPSS %25

    netic · group export17 Eyl 2022

  • CVE-2022-2753
    49Planlayın

    Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSS

    OrtaCVSS 6,1İstismar yokEPSS %83

    ketchup restaurant reservations project · ketchup restaurant reservations19 Eyl 2022

  • CVE-2022-2754
    51Planlayın

    Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Blind SQLi

    KritikCVSS 9,8İstismar yokEPSS %39

    ketchup restaurant reservations project · ketchup restaurant reservations19 Eyl 2022

  • CVE-2022-2840
    43Planlayın

    Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    zephyr-one · zephyr project manager19 Eyl 2022

  • CVE-2022-3142
    39İzleyin

    NEX-Forms < 7.9.7 - Authenticated SQLi

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    basixonline · nex-forms19 Eyl 2022

  • CVE-2022-35914
    99Hemen

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    glpi-project · glpi19 Eyl 2022

  • CVE-2022-3218
    61Bu hafta

    Necta WiFi Mouse (Mouse Server) client-side authentication bypass

    KritikCVSS 9,8SilahlaştırılmışEPSS %74

    necta · wifi mouse server19 Eyl 2022

  • CVE-2022-40139
    59Planlayın

    Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %3

    trendmicro · apex one19 Eyl 2022

  • CVE-2022-38545
    48Planlayın

    Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a

    KritikCVSS 9,6İstismar yokEPSS %34

    valine.js · valine19 Eyl 2022

  • CVE-2022-38916
    45Planlayın

    A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files

    KritikCVSS 9,8İstismar yokEPSS %18

    pagekit · pagekit20 Eyl 2022

  • CVE-2022-32917
    63Bu hafta

    The issue was addressed with improved bounds checks.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %5

    apple · ipados20 Eyl 2022

  • CVE-2022-37027
    35İzleyin

    Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options.

    YüksekCVSS 7,2İstismar yokEPSS %22

    ahsay · cloud backup suite21 Eyl 2022

  • CVE-2022-29799
    26İzleyin

    A vulnerability was found in networkd-dispatcher.

    OrtaCVSS 5,5Kavram kanıtıEPSS %11

    microsoft · windows defender for endpoint21 Eyl 2022

  • CVE-2022-39197
    68Bu hafta

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTM

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %46

    helpsystems · cobalt strike21 Eyl 2022

  • CVE-2022-3236
    99Hemen

    A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    sophos · firewall23 Eyl 2022

  • CVE-2022-40855
    43Planlayın

    Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'.

    KritikCVSS 9,8İstismar yokEPSS %14

    tenda · w20e firmware23 Eyl 2022

  • CVE-2022-38742
    46Planlayın

    Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack

    KritikCVSS 9,8İstismar yokEPSS %22

    rockwellautomation · thinmanager23 Eyl 2022

  • CVE-2022-36944
    42Planlayın

    Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file.

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    scala-lang · scala23 Eyl 2022

  • CVE-2022-41352
    98Hemen

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95

    synacor · zimbra collaboration suite25 Eyl 2022

  • CVE-2022-3062
    37İzleyin

    Simple File List < 4.4.12 - Reflected Cross-Site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %44

    simplefilelist · simple-file-list26 Eyl 2022

  • CVE-2022-2856
    57Planlayın

    Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbit

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %4

    google · chrome26 Eyl 2022

  • CVE-2022-2998
    44Planlayın

    Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in

    YüksekCVSS 8,8İstismar yokEPSS %30

    google · chrome26 Eyl 2022

  • CVE-2022-3038
    72Bu hafta

    Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption v

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %24

    google · chrome26 Eyl 2022

  • CVE-2022-3075
    70Bu hafta

    Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer pro

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %5

    google · chrome26 Eyl 2022

  • CVE-2022-3323
    39İzleyin

    An SQL injection vulnerability in Advantech iView 5.7.04.6469.

    YüksekCVSS 7,5İstismar yokEPSS %29

    advantech · iview27 Eyl 2022

  • CVE-2022-40878
    42Planlayın

    In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Exe

    YüksekCVSS 8,8İstismar yokEPSS %23

    exam reviewer management system project · exam reviewer management system27 Eyl 2022

  • CVE-2022-31629
    41Planlayın

    $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

    OrtaCVSS 6,5Kavram kanıtıEPSS %49

    php · php28 Eyl 2022

  • CVE-2022-21826
    35İzleyin

    Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request,

    OrtaCVSS 5,4İstismar yokEPSS %46

    ivanti · connect secure30 Eyl 2022

  • CVE-2022-28851
    32İzleyin

    AEM Reflected XSS Arbitrary code execution

    OrtaCVSS 5,4İstismar yokEPSS %36

    adobe · experience manager30 Eyl 2022

  • CVE-2022-36961
    57Planlayın

    Orion Platform SQL Injection Privilege Escalation Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %74

    solarwinds · orion platform30 Eyl 2022

  • CVE-2022-20775
    65Bu hafta

    Cisco SD-WAN Software Privilege Escalation Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %12

    cisco · catalyst sd-wan manager30 Eyl 2022