İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2022: sömürülen ve yeni ciddi CVE kayıtları

71 kayıt · 7 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-1471
    69Bu hafta

    Remote Code execution in SnakeYAML

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    snakeyaml project · snakeyaml1 Ara 2022

  • CVE-2022-4257
    52Planlayın

    C-DATA Web Management System GET Parameter jumpto.php argument injection

    KritikCVSS 9,8İstismar yokEPSS %43

    cdatatec · c-data web management system1 Ara 2022

  • CVE-2022-4262
    72Bu hafta

    Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %23

    google · chrome2 Ara 2022

  • CVE-2022-46164
    53Planlayın

    Account takeover via prototype vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %47

    nodebb · nodebb5 Ara 2022

  • CVE-2022-46169
    99Hemen

    Unauthenticated Command Injection

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    cacti · cacti5 Ara 2022

  • CVE-2022-43548
    36İzleyin

    A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost c

    YüksekCVSS 8,1İstismar yokEPSS %14

    nodejs · node.js5 Ara 2022

  • CVE-2020-6627
    43Planlayın

    The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_b

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    seagate · stcg2000300 firmware6 Ara 2022

  • CVE-2022-45359
    43Planlayın

    WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload

    KritikCVSS 9,8İstismar yokEPSS %13

    yithemes · yith woocommerce gift cards6 Ara 2022

  • CVE-2022-45025
    49Planlayın

    Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF fil

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    markdown preview enhanced project · markdown preview enhanced6 Ara 2022

  • CVE-2022-41622
    63Bu hafta

    iControl SOAP vulnerability

    YüksekCVSS 8,8SilahlaştırılmışEPSS %92

    f5 · big-iq centralized management7 Ara 2022

  • CVE-2022-41800
    57Planlayın

    Appliance mode iControl REST vulnerability

    YüksekCVSS 8,7SilahlaştırılmışEPSS %76

    f5 · big-ip access policy manager7 Ara 2022

  • CVE-2022-46770
    60Bu hafta

    qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumpt

    YüksekCVSS 7,5SilahlaştırılmışEPSS %22

    linuxfoundation · mirage firewall7 Ara 2022

  • CVE-2022-45504
    35İzleyin

    An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to

    YüksekCVSS 7,5İstismar yokEPSS %18

    tenda · w6-s firmware8 Ara 2022

  • CVE-2021-3437
    44Planlayın

    Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or den

    KritikCVSS 9,8İstismar yokEPSS %15

    hp · omen gaming hub12 Ara 2022

  • CVE-2022-45957
    33İzleyin

    ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.

    YüksekCVSS 7,5İstismar yokEPSS %10

    zte · zxhn-h108ns firmware12 Ara 2022

  • CVE-2022-3900
    45Planlayın

    Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection

    KritikCVSS 9,8İstismar yokEPSS %18

    boxystudio · cooked12 Ara 2022

  • CVE-2022-3921
    45Planlayın

    Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8İstismar yokEPSS %21

    themographics · listingo12 Ara 2022

  • CVE-2022-45275
    33İzleyin

    An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing System v1.0 allows att

    YüksekCVSS 7,2İstismar yokEPSS %15

    dynamic transaction queuing system project · dynamic transaction queuing system12 Ara 2022

  • CVE-2022-31698
    35İzleyin

    The vCenter Server contains a denial-of-service vulnerability in the content library service.

    OrtaCVSS 5,3İstismar yokEPSS %47

    vmware · cloud foundation13 Ara 2022

  • CVE-2022-4223
    59Planlayın

    The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities suc

    YüksekCVSS 8,8Kavram kanıtıEPSS %80

    pgadmin · pgadmin 413 Ara 2022

  • CVE-2022-27518
    71Bu hafta

    Unauthenticated remote arbitrary code execution

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %6

    citrix · application delivery controller firmware13 Ara 2022

  • CVE-2022-41076
    52Planlayın

    PowerShell Remote Code Execution Vulnerability

    YüksekCVSS 8,5İstismar yokEPSS %60

    microsoft · powershell13 Ara 2022

  • CVE-2022-44666
    43Planlayın

    Windows Contacts Remote Code Execution Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %41

    microsoft · windows 1013 Ara 2022

  • CVE-2022-44690
    60Bu hafta

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %82

    microsoft · sharepoint foundation13 Ara 2022

  • CVE-2022-44698
    74Bu hafta

    Windows SmartScreen Security Feature Bypass Vulnerability

    OrtaCVSS 5,4KEVSilahlaştırılmışEPSS %76

    microsoft · windows 10 160713 Ara 2022

  • CVE-2022-37155
    47Planlayın

    RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

    YüksekCVSS 8,8İstismar yokEPSS %39

    spip · spip13 Ara 2022

  • CVE-2022-42139
    40Planlayın

    Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL.

    YüksekCVSS 8,8İstismar yokEPSS %18

    deltaww · dvw-w02w2-e2 firmware13 Ara 2022

  • CVE-2022-46443
    46Planlayın

    mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter.

    YüksekCVSS 8,8Kavram kanıtıEPSS %37

    bangresto project · bangresto14 Ara 2022

  • CVE-2022-38488
    43Planlayın

    logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.

    KritikCVSS 9,8İstismar yokEPSS %14

    logrocket-oauth2-example project · logrocket-oauth2-example14 Ara 2022

  • CVE-2022-46768
    37İzleyin

    File name information disclosure vulnerability in Zabbix Web Service Report Generation

    OrtaCVSS 5,9İstismar yokEPSS %47

    zabbix · web service report generation15 Ara 2022

  • CVE-2022-27498
    38İzleyin

    A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10

    OrtaCVSS 6,5İstismar yokEPSS %38

    lansweeper · lansweeper15 Ara 2022

  • CVE-2022-29517
    52Planlayın

    A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0.

    YüksekCVSS 8,8İstismar yokEPSS %57

    lansweeper · lansweeper15 Ara 2022

  • CVE-2022-42856
    68Bu hafta

    A type confusion issue was addressed with improved state handling.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %8

    apple · safari15 Ara 2022

  • CVE-2022-42867
    45Planlayın

    A use after free issue was addressed with improved memory management.

    YüksekCVSS 8,8İstismar yokEPSS %34

    apple · safari15 Ara 2022

  • CVE-2022-46689
    42Planlayın

    A race condition was addressed with additional validation.

    YüksekCVSS 7,0SilahlaştırılmışEPSS %47

    apple · safari15 Ara 2022

  • CVE-2022-4606
    50Planlayın

    PHP Remote File Inclusion in flatpressblog/flatpress

    KritikCVSS 9,8İstismar yokEPSS %35

    flatpress · flatpress18 Ara 2022

  • CVE-2022-44456
    60Bu hafta

    CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server w

    KritikCVSS 9,8İstismar yokEPSS %69

    contec · conprosys hmi system18 Ara 2022

  • CVE-2022-3876
    26İzleyin

    Click Studios Passwordstate API authorization

    OrtaCVSS 6,5İstismar yokEPSS %0

    clickstudios · passwordstate19 Ara 2022

  • CVE-2022-4063
    42Planlayın

    InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    pluginus · inpost gallery19 Ara 2022

  • CVE-2022-45942
    42Planlayın

    A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.

    YüksekCVSS 8,8İstismar yokEPSS %21

    baijiacms project · baijiacms20 Ara 2022

  • CVE-2022-40624
    44Planlayın

    pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    pfsense · pfblockerng20 Ara 2022

  • CVE-2022-46020
    51Planlayın

    WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.

    KritikCVSS 9,8Kavram kanıtıEPSS %38

    wbce · wbce cms20 Ara 2022

  • CVE-2022-3184
    42Planlayın

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated u

    KritikCVSS 9,8İstismar yokEPSS %11

    dataprobe · iboot-pdu4-n20 firmware21 Ara 2022

  • CVE-2022-41654
    23İzleyin

    An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.

    OrtaCVSS 4,3İstismar yokEPSS %18

    ghost · ghost22 Ara 2022

  • CVE-2022-41697
    27İzleyin

    A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4.

    OrtaCVSS 5,3Kavram kanıtıEPSS %20

    ghost · ghost22 Ara 2022

  • CVE-2022-1529
    40Planlayın

    An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading t

    YüksekCVSS 8,8İstismar yokEPSS %17

    mozilla · firefox22 Ara 2022

  • CVE-2022-1802
    43Planlayın

    If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution

    YüksekCVSS 8,8Kavram kanıtıEPSS %26

    mozilla · firefox22 Ara 2022

  • CVE-2022-26485
    69Bu hafta

    Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %14

    mozilla · firefox22 Ara 2022

  • CVE-2022-26486
    69Bu hafta

    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %2

    mozilla · firefox22 Ara 2022

  • CVE-2022-2200
    42Planlayın

    If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading t

    YüksekCVSS 8,8İstismar yokEPSS %23

    mozilla · firefox22 Ara 2022

  • CVE-2022-23513
    33İzleyin

    Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint

    OrtaCVSS 5,3Kavram kanıtıEPSS %41

    pi-hole · adminlte22 Ara 2022

  • CVE-2022-40897
    24İzleyin

    Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted packag

    OrtaCVSS 5,9İstismar yokEPSS %2

    python · setuptools22 Ara 2022

  • CVE-2022-47938
    44Planlayın

    An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.

    OrtaCVSS 6,5İstismar yokEPSS %60

    linux · linux kernel23 Ara 2022

  • CVE-2022-47939
    53Planlayın

    An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.

    KritikCVSS 9,8İstismar yokEPSS %47

    linux · linux kernel23 Ara 2022

  • CVE-2022-45711
    45Planlayın

    IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckT

    KritikCVSS 9,8İstismar yokEPSS %20

    ip-com · m50 firmware23 Ara 2022

  • CVE-2022-43551
    35İzleyin

    A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.

    YüksekCVSS 7,5İstismar yokEPSS %16

    haxx · curl23 Ara 2022

  • CVE-2022-23854
    44Planlayın

    AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user

    YüksekCVSS 7,5Kavram kanıtıEPSS %46

    aveva · intouch access anywhere23 Ara 2022

  • CVE-2022-47945
    48Planlayın

    ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_o

    KritikCVSS 9,8Kavram kanıtıEPSS %28

    thinkphp · thinkphp23 Ara 2022

  • CVE-2022-47949
    46Planlayın

    The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execu

    KritikCVSS 9,8İstismar yokEPSS %23

    nintendo · animal crossing\24 Ara 2022

  • CVE-2021-4277
    21İzleyin

    fredsmith utils Filename screenshot_sync predictable state

    OrtaCVSS 5,3İstismar yokEPSS %0

    utils project · utils25 Ara 2022

  • CVE-2022-37706
    40Planlayın

    enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library fun

    YüksekCVSS 7,8SilahlaştırılmışEPSS %5

    enlightenment · enlightenment25 Ara 2022

  • CVE-2022-40005
    46Planlayın

    Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6

    YüksekCVSS 8,8İstismar yokEPSS %35

    intelbras · wifiber 120ac inmesh firmware25 Ara 2022

  • CVE-2021-45466
    56Planlayın

    In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to a

    KritikCVSS 9,8İstismar yokEPSS %55

    control-webpanel · webpanel26 Ara 2022

  • CVE-2021-45467
    60Bu hafta

    In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.ph

    KritikCVSS 9,8Kavram kanıtıEPSS %70

    control-webpanel · webpanel26 Ara 2022

  • CVE-2022-4120
    44Planlayın

    Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection

    KritikCVSS 9,8İstismar yokEPSS %18

    trumani · stop spammers26 Ara 2022

  • CVE-2022-4732
    39İzleyin

    Unrestricted Upload of File with Dangerous Type in microweber/microweber

    YüksekCVSS 7,2İstismar yokEPSS %38

    microweber · microweber27 Ara 2022

  • CVE-2022-48194
    45Planlayın

    TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS

    YüksekCVSS 8,8Kavram kanıtıEPSS %33

    tp-link · tl-wr902ac firmware30 Ara 2022

  • CVE-2022-4855
    46Planlayın

    SourceCodester Lead Management System login.php sql injection

    KritikCVSS 9,8İstismar yokEPSS %24

    lead management system project · lead management system30 Ara 2022

  • CVE-2022-43396
    52Planlayın

    Apache Kylin: Command injection by Useless configuration

    YüksekCVSS 8,8İstismar yokEPSS %55

    apache · kylin30 Ara 2022

  • CVE-2022-47126
    39İzleyin

    Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.

    KritikCVSS 9,8İstismar yokEPSS %0

    tenda · a15 firmware30 Ara 2022

  • CVE-2023-0028
    38İzleyin

    Cross-site Scripting (XSS) - Stored in linagora/twake

    OrtaCVSS 5,4İstismar yokEPSS %56

    linagora · twake31 Ara 2022