İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2022: sömürülen ve yeni ciddi CVE kayıtları

58 kayıt · 14 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-3801
    44Planlayın

    IBAX go-ibax rowsInfo sql injection

    YüksekCVSS 8,8İstismar yokEPSS %30

    ibax · go-ibax1 Kas 2022

  • CVE-2022-3602
    57Planlayın

    X.509 Email Address 4-byte Buffer Overflow

    YüksekCVSS 7,5Kavram kanıtıEPSS %90

    openssl · openssl1 Kas 2022

  • CVE-2022-3786
    58Planlayın

    X.509 Email Address Variable Length Buffer Overflow

    YüksekCVSS 7,5Kavram kanıtıEPSS %92

    openssl · openssl1 Kas 2022

  • CVE-2022-42827
    61Bu hafta

    An out-of-bounds write issue was addressed with improved bounds checking.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    apple · ipados1 Kas 2022

  • CVE-2022-3654
    42Planlayın

    Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a craf

    YüksekCVSS 8,8İstismar yokEPSS %23

    google · chrome1 Kas 2022

  • CVE-2022-3723
    67Bu hafta

    Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %7

    google · chrome1 Kas 2022

  • CVE-2022-38380
    24İzleyin

    An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticate

    OrtaCVSS 4,3İstismar yokEPSS %22

    fortinet · fortios2 Kas 2022

  • CVE-2022-39379
    52Planlayın

    Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

    KritikCVSS 9,8İstismar yokEPSS %44

    fluentd · fluentd2 Kas 2022

  • CVE-2022-39323
    50Planlayın

    SQL Injection on REST API in GLPI

    KritikCVSS 9,8İstismar yokEPSS %36

    glpi-project · glpi3 Kas 2022

  • CVE-2022-43571
    39İzleyin

    Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

    YüksekCVSS 8,8SilahlaştırılmışEPSS %14

    splunk · splunk3 Kas 2022

  • CVE-2022-43568
    37İzleyin

    Reflected Cross-Site Scripting via the radio template in Splunk Enterprise

    OrtaCVSS 6,1İstismar yokEPSS %42

    splunk · splunk4 Kas 2022

  • CVE-2022-43945
    37İzleyin

    The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow.

    YüksekCVSS 7,5İstismar yokEPSS %22

    linux · linux kernel4 Kas 2022

  • CVE-2022-44792
    42Planlayın

    handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by

    OrtaCVSS 6,5İstismar yokEPSS %52

    net-snmp · net-snmp6 Kas 2022

  • CVE-2022-44793
    42Planlayın

    handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be u

    OrtaCVSS 6,5İstismar yokEPSS %53

    net-snmp · net-snmp6 Kas 2022

  • CVE-2022-31199
    80Hemen

    Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Audito

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %36

    netwrix · auditor7 Kas 2022

  • CVE-2022-41049
    52Planlayın

    Windows Mark of the Web Security Feature Bypass Vulnerability

    OrtaCVSS 5,4KEVSilahlaştırılmışEPSS %2

    microsoft · windows 10 15079 Kas 2022

  • CVE-2022-41073
    62Bu hafta

    Windows Print Spooler Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %2

    microsoft · windows 10 15079 Kas 2022

  • CVE-2022-41080
    88Hemen

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %77

    microsoft · exchange server9 Kas 2022

  • CVE-2022-41091
    52Planlayın

    Windows Mark of the Web Security Feature Bypass Vulnerability

    OrtaCVSS 5,4KEVSilahlaştırılmışEPSS %1

    microsoft · windows 10 15079 Kas 2022

  • CVE-2022-41125
    62Bu hafta

    Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    microsoft · windows 10 15079 Kas 2022

  • CVE-2022-41128
    72Bu hafta

    Windows Scripting Languages Remote Code Execution Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %24

    microsoft · windows 10 15079 Kas 2022

  • CVE-2022-3265
    47Planlayın

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prio

    OrtaCVSS 5,4İstismar yokEPSS %86

    gitlab · gitlab9 Kas 2022

  • CVE-2022-39396
    51Planlayın

    Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

    KritikCVSS 9,8İstismar yokEPSS %38

    parseplatform · parse-server9 Kas 2022

  • CVE-2022-38120
    28İzleyin

    POWERCOM CO., LTD. UPSMON PRO - Path Traversal

    OrtaCVSS 6,5SilahlaştırılmışEPSS %6

    upspowercom · upsmon pro10 Kas 2022

  • CVE-2022-38121
    27İzleyin

    POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials

    OrtaCVSS 6,5SilahlaştırılmışEPSS %3

    upspowercom · upsmon pro10 Kas 2022

  • CVE-2022-44088
    45Planlayın

    ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.

    KritikCVSS 9,8İstismar yokEPSS %20

    ecisp · espcms10 Kas 2022

  • CVE-2022-39393
    34İzleyin

    Wasmtime vulnerable to data leakage between instances in the pooling allocator

    YüksekCVSS 8,6İstismar yokEPSS %0

    bytecodealliance · wasmtime10 Kas 2022

  • CVE-2022-43671
    61Bu hafta

    Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.

    KritikCVSS 9,8İstismar yokEPSS %74

    zohocorp · manageengine access manager plus12 Kas 2022

  • CVE-2022-43672
    59Planlayın

    Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a diffe

    KritikCVSS 9,8İstismar yokEPSS %67

    zohocorp · manageengine access manager plus12 Kas 2022

  • CVE-2022-40127
    61Bu hafta

    Apache Airflow <2.4.0 has an RCE in a bash example

    YüksekCVSS 8,8Kavram kanıtıEPSS %85

    apache · airflow14 Kas 2022

  • CVE-2022-37109
    54Planlayın

    patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control.

    KritikCVSS 9,8Kavram kanıtıEPSS %49

    camp project · camp14 Kas 2022

  • CVE-2022-40843
    28İzleyin

    The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the rou

    OrtaCVSS 4,9Kavram kanıtıEPSS %28

    tenda · w15e firmware14 Kas 2022

  • CVE-2022-45402
    49Planlayın

    Apache Airflow: Open redirect during login

    OrtaCVSS 6,1İstismar yokEPSS %81

    apache · airflow15 Kas 2022

  • CVE-2022-43781
    68Bu hafta

    There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.

    KritikCVSS 9,8SilahlaştırılmışEPSS %98

    atlassian · bitbucket16 Kas 2022

  • CVE-2022-40881
    48Planlayın

    SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php

    KritikCVSS 9,8Kavram kanıtıEPSS %30

    contec · solarview compact firmware17 Kas 2022

  • CVE-2022-44384
    37İzleyin

    An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %5

    rconfig · rconfig17 Kas 2022

  • CVE-2022-23748
    63Bu hafta

    mDNSResponder.exe is vulnerable to DLL Sideloading attack.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %8

    audinate · dante application library17 Kas 2022

  • CVE-2022-42904
    53Planlayın

    Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.

    YüksekCVSS 7,2İstismar yokEPSS %83

    zohocorp · manageengine admanager plus18 Kas 2022

  • CVE-2022-3562
    49Planlayın

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    OrtaCVSS 5,4İstismar yokEPSS %94

    librenms · librenms20 Kas 2022

  • CVE-2022-4067
    49Planlayın

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    OrtaCVSS 5,4İstismar yokEPSS %93

    librenms · librenms20 Kas 2022

  • CVE-2022-4068
    32İzleyin

    Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms

    OrtaCVSS 5,4İstismar yokEPSS %35

    librenms · librenms20 Kas 2022

  • CVE-2022-4069
    47Planlayın

    Cross-site Scripting (XSS) - Generic in librenms/librenms

    OrtaCVSS 4,8İstismar yokEPSS %93

    librenms · librenms20 Kas 2022

  • CVE-2022-40765
    60Bu hafta

    A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker wit

    OrtaCVSS 6,8KEVSilahlaştırılmışEPSS %10

    mitel · mivoice connect21 Kas 2022

  • CVE-2022-41223
    60Bu hafta

    The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injec

    OrtaCVSS 6,8KEVSilahlaştırılmışEPSS %10

    mitel · mivoice connect21 Kas 2022

  • CVE-2022-39066
    43Planlayın

    There is a SQL injection vulnerability in ZTE MF286R.

    YüksekCVSS 8,8Kavram kanıtıEPSS %26

    zte · mf286r firmware22 Kas 2022

  • CVE-2022-4116
    49Planlayın

    A vulnerability was found in quarkus.

    KritikCVSS 9,8İstismar yokEPSS %32

    quarkus · quarkus22 Kas 2022

  • CVE-2020-23584
    51Planlayın

    Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands wit

    KritikCVSS 9,8Kavram kanıtıEPSS %41

    optilinknetwork · op-xt71000n firmware22 Kas 2022

  • CVE-2022-40770
    52Planlayın

    Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.

    YüksekCVSS 7,2İstismar yokEPSS %81

    zohocorp · manageengine servicedesk plus22 Kas 2022

  • CVE-2022-40303
    42Planlayın

    An issue was discovered in libxml2 before 2.10.3.

    YüksekCVSS 7,5İstismar yokEPSS %41

    xmlsoft · libxml223 Kas 2022

  • CVE-2021-43258
    38İzleyin

    CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %11

    churchdb · churchinfo23 Kas 2022

  • CVE-2022-4135
    78Bu hafta

    Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to p

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %31

    google · chrome24 Kas 2022

  • CVE-2022-24999
    35İzleyin

    qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express applicat

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    qs project · qs26 Kas 2022

  • CVE-2022-45933
    55Planlayın

    KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentic

    KritikCVSS 9,8Kavram kanıtıEPSS %51

    kubeview project · kubeview26 Kas 2022

  • CVE-2022-38900
    37İzleyin

    decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

    YüksekCVSS 7,5İstismar yokEPSS %23

    decode-uri-component project · decode-uri-component28 Kas 2022

  • CVE-2022-40799
    75Bu hafta

    Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %33

    dlink · dnr-322l firmware29 Kas 2022

  • CVE-2022-44635
    56Planlayın

    Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal

    YüksekCVSS 8,8İstismar yokEPSS %68

    apache · fineract29 Kas 2022

  • CVE-2022-36964
    40Planlayın

    SolarWinds Platform Deserialization of Untrusted Data

    YüksekCVSS 8,8İstismar yokEPSS %17

    solarwinds · orion platform29 Kas 2022

  • CVE-2022-4178
    42Planlayın

    Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potenti

    YüksekCVSS 8,8İstismar yokEPSS %23

    google · chrome29 Kas 2022