İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2023: sömürülen ve yeni ciddi CVE kayıtları

91 kayıt · 8 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-34324
    39İzleyin

    Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add

    YüksekCVSS 8,8İstismar yokEPSS %11

    sage · sage xrt business exchange1 Oca 2023

  • CVE-2022-42475
    99Hemen

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    fortinet · fortios2 Oca 2023

  • CVE-2022-4302
    33İzleyin

    White Label CMS < 2.5 - Admin+ PHP Object Injection

    YüksekCVSS 7,2İstismar yokEPSS %17

    videousermanuals · white label cms2 Oca 2023

  • CVE-2022-4324
    33İzleyin

    Custom Field Template < 2.5.8 - Admin+ PHP Object Injection

    YüksekCVSS 7,2İstismar yokEPSS %17

    wpgogo · custom field template2 Oca 2023

  • CVE-2021-30558
    38İzleyin

    Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten

    YüksekCVSS 8,8İstismar yokEPSS %11

    google · chrome2 Oca 2023

  • CVE-2022-3842
    35İzleyin

    Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to p

    YüksekCVSS 7,5İstismar yokEPSS %18

    google · chrome2 Oca 2023

  • CVE-2022-43931
    45Planlayın

    Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote

    KritikCVSS 10,0İstismar yokEPSS %16

    synology · vpn plus server3 Oca 2023

  • CVE-2023-0048
    44Planlayın

    Code Injection in lirantal/daloradius

    YüksekCVSS 8,8İstismar yokEPSS %30

    daloradius · daloradius4 Oca 2023

  • CVE-2023-22457
    41Planlayın

    org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery

    YüksekCVSS 8,8İstismar yokEPSS %19

    xwiki · ckeditor integration4 Oca 2023

  • CVE-2023-22463
    60Bu hafta

    KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

    KritikCVSS 9,8Kavram kanıtıEPSS %69

    fit2cloud · kubepi4 Oca 2023

  • CVE-2022-47523
    60Bu hafta

    Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection

    KritikCVSS 9,8İstismar yokEPSS %70

    zohocorp · manageengine password manager pro5 Oca 2023

  • CVE-2022-44877
    99Hemen

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS comma

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    control-webpanel · webpanel5 Oca 2023

  • CVE-2022-42979
    42Planlayın

    Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take ov

    YüksekCVSS 8,8İstismar yokEPSS %24

    rydesharing · ryde6 Oca 2023

  • CVE-2022-44149
    54Planlayın

    The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in

    YüksekCVSS 8,8Kavram kanıtıEPSS %64

    nexxtsolutions · amp300 firmware6 Oca 2023

  • CVE-2022-43970
    34İzleyin

    Buffer overflow in Linksys WRT54GL

    YüksekCVSS 7,2İstismar yokEPSS %19

    linksys · wrt54gl firmware9 Oca 2023

  • CVE-2022-3416
    33İzleyin

    WPtouch < 4.3.45 - Admin+ Arbitrary File Upload

    YüksekCVSS 7,2İstismar yokEPSS %17

    bravenewcode · wptouch9 Oca 2023

  • CVE-2022-4043
    33İzleyin

    WP Custom Admin Interface < 7.29 - Admin+ PHP Object Injection

    YüksekCVSS 7,2İstismar yokEPSS %17

    wp custom admin interface project · wp custom admin interface9 Oca 2023

  • CVE-2023-0017
    44Planlayın

    Improper access control in SAP NetWeaver AS for Java

    KritikCVSS 9,8İstismar yokEPSS %15

    sap · netweaver application server for java10 Oca 2023

  • CVE-2022-45092
    44Planlayın

    A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1).

    YüksekCVSS 8,8İstismar yokEPSS %31

    siemens · sinec ins10 Oca 2023

  • CVE-2022-3792
    43Planlayın

    SQL Injection in GullsEye Terminal Operating System

    KritikCVSS 9,8İstismar yokEPSS %14

    gullseye · gullseye terminal operating system10 Oca 2023

  • CVE-2022-46610
    40Planlayın

    72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function.

    YüksekCVSS 8,8İstismar yokEPSS %18

    72crm · wukong crm10 Oca 2023

  • CVE-2022-47083
    40Planlayın

    A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary

    YüksekCVSS 8,8İstismar yokEPSS %18

    spitfire project · spitfire10 Oca 2023

  • CVE-2022-35401
    38İzleyin

    An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230.

    YüksekCVSS 8,1İstismar yokEPSS %20

    asus · rt-ax82u firmware10 Oca 2023

  • CVE-2022-38393
    36İzleyin

    A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 rout

    YüksekCVSS 7,5İstismar yokEPSS %18

    asus · rt-ax82u firmware10 Oca 2023

  • CVE-2023-21547
    57Planlayın

    Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %89

    microsoft · windows 10 160710 Oca 2023

  • CVE-2023-21674
    77Bu hafta

    Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %40

    microsoft · windows 10 150710 Oca 2023

  • CVE-2023-21742
    52Planlayın

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %55

    microsoft · sharepoint foundation10 Oca 2023

  • CVE-2023-21758
    58Planlayın

    Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %92

    microsoft · windows 1010 Oca 2023

  • CVE-2023-21768
    51Planlayın

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    YüksekCVSS 7,8SilahlaştırılmışEPSS %65

    microsoft · windows 1110 Oca 2023

  • CVE-2023-22959
    39İzleyin

    WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).

    YüksekCVSS 8,8İstismar yokEPSS %13

    webchess project · webchess11 Oca 2023

  • CVE-2023-22952
    89Hemen

    In SugarCRM before 12.0.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %80

    sugarcrm · sugarcrm11 Oca 2023

  • CVE-2022-4874
    33İzleyin

    Authenticated bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows unauthenticated user to get access to content.

    YüksekCVSS 7,5İstismar yokEPSS %11

    netcommwireless · nf20 firmware11 Oca 2023

  • CVE-2022-25026
    37İzleyin

    A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on th

    YüksekCVSS 7,5İstismar yokEPSS %24

    rocketsoftware · trufusion enterprise12 Oca 2023

  • CVE-2022-46502
    43Planlayın

    Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollm

    KritikCVSS 9,8İstismar yokEPSS %13

    online student enrollment system project · online student enrollment system12 Oca 2023

  • CVE-2023-22480
    59Planlayın

    KubeOperator is vulnerable to unauthorized access to system API

    KritikCVSS 9,8Kavram kanıtıEPSS %66

    fit2cloud · kubeoperator13 Oca 2023

  • CVE-2023-22496
    50Planlayın

    Netdata vulnerable to command injection

    KritikCVSS 9,8Kavram kanıtıEPSS %36

    netdata · netdata13 Oca 2023

  • CVE-2023-0297
    68Bu hafta

    Code Injection in pyload/pyload

    KritikCVSS 9,8SilahlaştırılmışEPSS %95

    pyload · pyload13 Oca 2023

  • CVE-2022-1812
    48Planlayın

    Integer Overflow or Wraparound in publify/publify

    KritikCVSS 9,8İstismar yokEPSS %30

    publify project · publify14 Oca 2023

  • CVE-2023-23590
    38İzleyin

    Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated

    YüksekCVSS 7,5İstismar yokEPSS %26

    mercedes-benz · xentry retail data storage firmware15 Oca 2023

  • CVE-2023-0315
    64Bu hafta

    Command Injection in froxlor/froxlor

    YüksekCVSS 8,8SilahlaştırılmışEPSS %97

    froxlor · froxlor15 Oca 2023

  • CVE-2023-0324
    45Planlayın

    SourceCodester Online Tours & Travels Management System page-login.php sql injection

    KritikCVSS 9,8İstismar yokEPSS %18

    online tours \& travels management system project · online tours \& travels management system16 Oca 2023

  • CVE-2022-4060
    52Planlayın

    User Post Gallery <= 2.19 - Unauthenticated RCE

    KritikCVSS 9,8Kavram kanıtıEPSS %42

    odude · user post gallery16 Oca 2023

  • CVE-2022-4101
    45Planlayın

    Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

    KritikCVSS 9,1İstismar yokEPSS %29

    images optimize and upload cf7 project · images optimize and upload cf716 Oca 2023

  • CVE-2022-37436
    38İzleyin

    Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting

    OrtaCVSS 5,3İstismar yokEPSS %55

    apache · http server17 Oca 2023

  • CVE-2021-32837
    39İzleyin

    mechanize vulnerable to ReDoS

    YüksekCVSS 7,5İstismar yokEPSS %28

    mechanize project · mechanize17 Oca 2023

  • CVE-2022-23521
    56Planlayın

    gitattributes parsing integer overflow in git

    KritikCVSS 9,8İstismar yokEPSS %56

    git-scm · git17 Oca 2023

  • CVE-2022-41903
    52Planlayın

    Integer overflow in `git archive`, `git log --format` leading to RCE in git

    KritikCVSS 9,8Kavram kanıtıEPSS %44

    git-scm · git17 Oca 2023

  • CVE-2023-21839
    90Hemen

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    oracle · weblogic server17 Oca 2023

  • CVE-2023-21887
    32İzleyin

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).

    OrtaCVSS 4,9Kavram kanıtıEPSS %43

    oracle · mysql17 Oca 2023

  • CVE-2021-33959
    35İzleyin

    Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    plex · media server18 Oca 2023

  • CVE-2023-22809
    48Planlayın

    In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_ED

    YüksekCVSS 7,8SilahlaştırılmışEPSS %55

    sudo project · sudo18 Oca 2023

  • CVE-2022-47966
    99Hemen

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    zohocorp · manageengine access manager plus18 Oca 2023

  • CVE-2020-35326
    43Planlayın

    SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0

    KritikCVSS 9,8İstismar yokEPSS %13

    inxedu · inxedu18 Oca 2023

  • CVE-2023-21608
    79Bu hafta

    Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %59

    adobe · acrobat dc18 Oca 2023

  • CVE-2022-45925
    35İzleyin

    An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).

    YüksekCVSS 7,5İstismar yokEPSS %16

    opentext · opentext extended ecm18 Oca 2023

  • CVE-2022-45926
    40Planlayın

    An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).

    YüksekCVSS 8,8İstismar yokEPSS %16

    opentext · opentext extended ecm18 Oca 2023

  • CVE-2022-47745
    40Planlayın

    ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection.

    YüksekCVSS 8,8İstismar yokEPSS %15

    easycorp · zentao19 Oca 2023

  • CVE-2022-46887
    45Planlayın

    Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[]

    KritikCVSS 9,8İstismar yokEPSS %19

    nexusphp · nexusphp19 Oca 2023

  • CVE-2022-46889
    39İzleyin

    A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject

    OrtaCVSS 5,4İstismar yokEPSS %60

    nexusphp · nexusphp19 Oca 2023

  • CVE-2023-0126
    52Planlayın

    Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbit

    YüksekCVSS 7,5Kavram kanıtıEPSS %73

    sonicwall · sma1000 firmware19 Oca 2023

  • CVE-2022-46476
    51Planlayın

    D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.

    KritikCVSS 9,8İstismar yokEPSS %41

    dlink · dir-859 a1 firmware19 Oca 2023

  • CVE-2022-20964
    44Planlayın

    A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inj

    YüksekCVSS 8,8İstismar yokEPSS %30

    cisco · identity services engine20 Oca 2023

  • CVE-2022-20966
    29İzleyin

    A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to con

    OrtaCVSS 5,4İstismar yokEPSS %27

    cisco · identity services engine20 Oca 2023

  • CVE-2023-23596
    40Planlayın

    jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection.

    YüksekCVSS 8,8İstismar yokEPSS %15

    jc21 · nginx proxy manager20 Oca 2023

  • CVE-2023-23488
    67Bu hafta

    The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' para

    KritikCVSS 9,8SilahlaştırılmışEPSS %92

    strangerstudios · paid memberships pro20 Oca 2023

  • CVE-2023-23489
    42Planlayın

    The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in th

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    sandhillsdev · easy digital downloads20 Oca 2023

  • CVE-2022-35977
    26İzleyin

    Integer overflow in certain command arguments can drive Redis to OOM panic

    OrtaCVSS 5,5İstismar yokEPSS %13

    redis · redis20 Oca 2023

  • CVE-2023-22458
    44Planlayın

    Integer overflow in multiple Redis commands can lead to denial-of-service

    OrtaCVSS 5,5İstismar yokEPSS %71

    redis · redis20 Oca 2023

  • CVE-2023-23492
    52Planlayın

    The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' param

    YüksekCVSS 8,8Kavram kanıtıEPSS %57

    idehweb · login with phone number20 Oca 2023

  • CVE-2023-22884
    42Planlayın

    Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    apache · airflow21 Oca 2023

  • CVE-2022-4230
    46Planlayın

    WP Statistics < 13.2.9 - Authenticated SQLi

    YüksekCVSS 8,8İstismar yokEPSS %35

    veronalabs · wp statistics23 Oca 2023

  • CVE-2022-4305
    51Planlayın

    Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

    KritikCVSS 9,8Kavram kanıtıEPSS %38

    wp-buy · login as user or customer \(user switching\)23 Oca 2023

  • CVE-2023-22960
    38İzleyin

    Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.

    YüksekCVSS 7,5Kavram kanıtıEPSS %27

    lexmark · b2236 firmware23 Oca 2023

  • CVE-2023-23560
    43Planlayın

    In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.

    KritikCVSS 9,8İstismar yokEPSS %13

    lexmark · b2236 firmware23 Oca 2023

  • CVE-2022-41142
    61Bu hafta

    This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.

    YüksekCVSS 8,8İstismar yokEPSS %85

    centreon · centreon26 Oca 2023

  • CVE-2021-41988
    31İzleyin

    Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.

    YüksekCVSS 7,8İstismar yokEPSS %0

    qlik · nprinting designer26 Oca 2023

  • CVE-2022-29844
    50Planlayın

    Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp

    KritikCVSS 9,8İstismar yokEPSS %36

    westerndigital · my cloud pr2100 firmware26 Oca 2023

  • CVE-2022-31704
    63Bu hafta

    The vRealize Log Insight contains a broken access control vulnerability.

    KritikCVSS 9,8SilahlaştırılmışEPSS %81

    vmware · vrealize log insight26 Oca 2023

  • CVE-2022-31706
    65Bu hafta

    The vRealize Log Insight contains a Directory Traversal Vulnerability.

    KritikCVSS 9,8SilahlaştırılmışEPSS %87

    vmware · vrealize log insight26 Oca 2023

  • CVE-2022-31711
    28İzleyin

    VMware vRealize Log Insight contains an Information Disclosure Vulnerability.

    OrtaCVSS 5,3SilahlaştırılmışEPSS %23

    vmware · vrealize log insight26 Oca 2023

  • CVE-2022-3094
    34İzleyin

    An UPDATE message flood may cause named to exhaust all available memory

    YüksekCVSS 7,5İstismar yokEPSS %13

    isc · bind26 Oca 2023

  • CVE-2022-3488
    36İzleyin

    named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries

    YüksekCVSS 7,5İstismar yokEPSS %19

    isc · bind26 Oca 2023

  • CVE-2022-3736
    45Planlayın

    named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries

    YüksekCVSS 7,5İstismar yokEPSS %48

    isc · bind26 Oca 2023

  • CVE-2022-3924
    35İzleyin

    named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota

    YüksekCVSS 7,5İstismar yokEPSS %16

    isc · bind26 Oca 2023

  • CVE-2022-4510
    38İzleyin

    Path Traversal in binwalk

    YüksekCVSS 7,8Kavram kanıtıEPSS %22

    microsoft · binwalk26 Oca 2023

  • CVE-2023-0448
    37İzleyin

    The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cro

    OrtaCVSS 6,1Kavram kanıtıEPSS %42

    matbao · wp helper premium26 Oca 2023

  • CVE-2023-0562
    52Planlayın

    PHPGurukul Bank Locker Management System Login index.php sql injection

    KritikCVSS 9,8Kavram kanıtıEPSS %44

    phpgurukul · bank locker management system28 Oca 2023

  • CVE-2023-0563
    30İzleyin

    PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting

    OrtaCVSS 4,8Kavram kanıtıEPSS %37

    phpgurukul · bank locker management system28 Oca 2023

  • CVE-2023-0266
    59Planlayın

    Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %3

    linux · linux kernel30 Oca 2023

  • CVE-2022-4395
    44Planlayın

    Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    wpswings · membership for woocommerce30 Oca 2023

  • CVE-2023-0587
    54Planlayın

    A file upload vulnerability in exists in Trend Micro Apex One server build 11110.

    KritikCVSS 9,1İstismar yokEPSS %59

    trendmicro · apex one31 Oca 2023