İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2022: sömürülen ve yeni ciddi CVE kayıtları

65 kayıt · 8 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-41040
    95Hemen

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    microsoft · exchange server2 Eki 2022

  • CVE-2022-41082
    92Hemen

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,0KEVSilahlaştırılmışEPSS %99

    microsoft · exchange server2 Eki 2022

  • CVE-2022-31680
    46Planlayın

    The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller).

    KritikCVSS 9,1İstismar yokEPSS %33

    vmware · vcenter server7 Eki 2022

  • CVE-2022-36635
    40Planlayın

    ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.

    YüksekCVSS 8,8İstismar yokEPSS %17

    zkteco · zkbiosecurity v50007 Eki 2022

  • CVE-2022-39288
    48Planlayın

    Denial of service in Fastify via Content-Type header

    YüksekCVSS 7,5İstismar yokEPSS %59

    fastify · fastify10 Eki 2022

  • CVE-2022-32174
    53Planlayın

    In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

    KritikCVSS 9,0İstismar yokEPSS %58

    gogs · gogs11 Eki 2022

  • CVE-2022-3358
    60Bu hafta

    Using a Custom Cipher with NID_undef may lead to NULL encryption

    YüksekCVSS 7,5SilahlaştırılmışEPSS %4

    openssl · openssl11 Eki 2022

  • CVE-2022-34689
    41Planlayın

    Windows CryptoAPI Spoofing Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %37

    microsoft · windows 1011 Eki 2022

  • CVE-2022-35829
    25İzleyin

    Service Fabric Explorer Spoofing Vulnerability

    OrtaCVSS 4,8İstismar yokEPSS %18

    microsoft · azure service fabric11 Eki 2022

  • CVE-2022-37974
    37İzleyin

    Windows Mixed Reality Developer Tools Information Disclosure Vulnerability

    OrtaCVSS 6,5İstismar yokEPSS %36

    microsoft · windows 1011 Eki 2022

  • CVE-2022-37985
    34İzleyin

    Windows Graphics Component Information Disclosure Vulnerability

    OrtaCVSS 5,5İstismar yokEPSS %38

    microsoft · windows 1011 Eki 2022

  • CVE-2022-38028
    65Bu hafta

    Windows Print Spooler Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %14

    microsoft · windows 10 150711 Eki 2022

  • CVE-2022-38044
    48Planlayın

    Windows CD-ROM File System Driver Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %56

    microsoft · windows 1011 Eki 2022

  • CVE-2022-38053
    58Planlayın

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %76

    microsoft · sharepoint enterprise server11 Eki 2022

  • CVE-2022-41033
    62Bu hafta

    Windows COM+ Event System Service Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    microsoft · windows 10 150711 Eki 2022

  • CVE-2022-41034
    51Planlayın

    Visual Studio Code Remote Code Execution Vulnerability

    YüksekCVSS 7,8SilahlaştırılmışEPSS %67

    microsoft · visual studio code11 Eki 2022

  • CVE-2022-40871
    49Planlayın

    Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.

    KritikCVSS 9,8İstismar yokEPSS %33

    dolibarr · dolibarr erp\/crm12 Eki 2022

  • CVE-2022-42897
    39İzleyin

    Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and cont

    KritikCVSS 9,8İstismar yokEPSS %1

    arraynetworks · arrayos ag12 Eki 2022

  • CVE-2022-24697
    64Bu hafta

    Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

    KritikCVSS 9,8İstismar yokEPSS %84

    apache · kylin13 Eki 2022

  • CVE-2022-42889
    69Bu hafta

    Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    apache · commons text13 Eki 2022

  • CVE-2022-35690
    61Bu hafta

    Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %72

    adobe · coldfusion14 Eki 2022

  • CVE-2022-35698
    25İzleyin

    Adobe Commerce Stored XSS Arbitrary code execution

    OrtaCVSS 5,4Kavram kanıtıEPSS %14

    adobe · commerce14 Eki 2022

  • CVE-2022-35710
    52Planlayın

    Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %43

    adobe · coldfusion14 Eki 2022

  • CVE-2022-35711
    61Bu hafta

    Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %73

    adobe · coldfusion14 Eki 2022

  • CVE-2022-35712
    50Planlayın

    Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %37

    adobe · coldfusion14 Eki 2022

  • CVE-2022-38418
    63Bu hafta

    Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %80

    adobe · coldfusion14 Eki 2022

  • CVE-2022-38419
    46Planlayın

    Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read

    YüksekCVSS 7,5İstismar yokEPSS %53

    adobe · coldfusion14 Eki 2022

  • CVE-2022-38420
    43Planlayın

    Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service

    YüksekCVSS 7,5İstismar yokEPSS %44

    adobe · coldfusion14 Eki 2022

  • CVE-2022-38421
    52Planlayın

    Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %79

    adobe · coldfusion14 Eki 2022

  • CVE-2022-38422
    43Planlayın

    Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %44

    adobe · coldfusion14 Eki 2022

  • CVE-2022-38423
    33İzleyin

    Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability

    OrtaCVSS 4,9İstismar yokEPSS %45

    adobe · coldfusion14 Eki 2022

  • CVE-2022-38424
    42Planlayın

    Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write

    YüksekCVSS 7,2İstismar yokEPSS %45

    adobe · coldfusion14 Eki 2022

  • CVE-2022-42340
    40Planlayın

    Adobe ColdFusion Improper Input Validation Arbitrary file system read

    YüksekCVSS 7,5İstismar yokEPSS %34

    adobe · coldfusion14 Eki 2022

  • CVE-2022-42341
    41Planlayın

    Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read

    YüksekCVSS 7,5İstismar yokEPSS %36

    adobe · coldfusion14 Eki 2022

  • CVE-2022-2884
    62Bu hafta

    A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an auth

    KritikCVSS 9,9Kavram kanıtıEPSS %75

    gitlab · gitlab17 Eki 2022

  • CVE-2022-2992
    65Bu hafta

    A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated us

    KritikCVSS 9,9SilahlaştırılmışEPSS %86

    gitlab · gitlab17 Eki 2022

  • CVE-2022-3552
    41Planlayın

    Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling

    YüksekCVSS 7,2Kavram kanıtıEPSS %44

    boxbilling · boxbilling17 Eki 2022

  • CVE-2022-3569
    40Planlayın

    Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in version

    YüksekCVSS 7,8SilahlaştırılmışEPSS %0

    synacor · zimbra collaboration suite17 Eki 2022

  • CVE-2022-40684
    99Hemen

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    fortinet · fortiproxy18 Eki 2022

  • CVE-2022-41544
    43Planlayın

    GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edi

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    get-simple · getsimple cms18 Eki 2022

  • CVE-2022-21587
    99Hemen

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    oracle · e-business suite18 Eki 2022

  • CVE-2022-39428
    50Planlayın

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

    KritikCVSS 9,8İstismar yokEPSS %37

    oracle · web applications desktop integrator18 Eki 2022

  • CVE-2016-20016
    65Bu hafta

    MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.

    KritikCVSS 9,8SilahlaştırılmışEPSS %86

    mvpower · tv-7104he firmware19 Eki 2022

  • CVE-2016-20017
    89Hemen

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %66

    dlink · dsl-2750b firmware19 Eki 2022

  • CVE-2022-42233
    52Planlayın

    Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    tenda · 11n firmware20 Eki 2022

  • CVE-2022-36957
    32İzleyin

    SolarWinds Platform Deserialization of Untrusted Data

    YüksekCVSS 7,2İstismar yokEPSS %14

    solarwinds · orion platform20 Eki 2022

  • CVE-2022-36958
    59Planlayın

    SolarWinds Platform Deserialization of Untrusted Data

    YüksekCVSS 8,8İstismar yokEPSS %81

    solarwinds · orion platform20 Eki 2022

  • CVE-2022-38108
    48Planlayın

    SolarWinds Platform Deserialization of Untrusted Data

    YüksekCVSS 7,2SilahlaştırılmışEPSS %65

    solarwinds · orion platform20 Eki 2022

  • CVE-2022-38580
    43Planlayın

    Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    zalando · skipper25 Eki 2022

  • CVE-2022-41704
    31İzleyin

    Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input

    YüksekCVSS 7,5İstismar yokEPSS %2

    apache · batik25 Eki 2022

  • CVE-2022-38181
    69Bu hafta

    The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %14

    arm · bifrost gpu kernel driver25 Eki 2022

  • CVE-2022-20811
    28İzleyin

    Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

    YüksekCVSS 7,2İstismar yokEPSS %0

    cisco · telepresence collaboration endpoint26 Eki 2022

  • CVE-2022-43775
    45Planlayın

    The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on

    KritikCVSS 9,8İstismar yokEPSS %20

    deltaww · diaenergie26 Eki 2022

  • CVE-2022-31898
    32İzleyin

    gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the p

    OrtaCVSS 6,8Kavram kanıtıEPSS %15

    gl-inet · gl-mt300n-v2 firmware27 Eki 2022

  • CVE-2022-3387
    25İzleyin

    Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks.

    OrtaCVSS 5,3İstismar yokEPSS %13

    advantech · r-seenet27 Eki 2022

  • CVE-2022-40965
    24İzleyin

    Delta Electronics DIAEnergie

    OrtaCVSS 5,4İstismar yokEPSS %11

    deltaww · diaenergie27 Eki 2022

  • CVE-2022-41133
    43Planlayın

    Delta Electronics DIAEnergie

    YüksekCVSS 8,8İstismar yokEPSS %26

    deltaww · diaenergie27 Eki 2022

  • CVE-2022-41555
    24İzleyin

    Delta Electronics DIAEnergie

    OrtaCVSS 5,4İstismar yokEPSS %11

    deltaww · diaenergie27 Eki 2022

  • CVE-2022-41651
    24İzleyin

    Delta Electronics DIAEnergie

    OrtaCVSS 5,4İstismar yokEPSS %11

    deltaww · diaenergie27 Eki 2022

  • CVE-2022-41701
    24İzleyin

    Delta Electronics DIAEnergie

    OrtaCVSS 5,4İstismar yokEPSS %11

    deltaww · diaenergie27 Eki 2022

  • CVE-2022-41702
    24İzleyin

    Delta Electronics DIAEnergie

    OrtaCVSS 5,4İstismar yokEPSS %11

    deltaww · diaenergie27 Eki 2022

  • CVE-2022-40471
    60Bu hafta

    Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture uploa

    KritikCVSS 9,8SilahlaştırılmışEPSS %22

    oretnom23 · clinic\'s patient management system31 Eki 2022

  • CVE-2022-38142
    44Planlayın

    Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway

    KritikCVSS 9,8İstismar yokEPSS %18

    deltaww · infrasuite device master31 Eki 2022

  • CVE-2022-41657
    45Planlayın

    Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be u

    KritikCVSS 9,8İstismar yokEPSS %20

    deltaww · infrasuite device master31 Eki 2022

  • CVE-2022-41772
    46Planlayın

    Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversa

    KritikCVSS 9,8İstismar yokEPSS %24

    deltaww · infrasuite device master31 Eki 2022