İçeriğe atla
Noroxi

Yayın tarihine göre

Şubat 2023: sömürülen ve yeni ciddi CVE kayıtları

90 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2023-22374
    56Planlayın

    iControl SOAP vulnerability

    YüksekCVSS 8,5İstismar yokEPSS %72

    f5 · big-ip access policy manager1 Şub 2023

  • CVE-2023-22501
    41Planlayın

    An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate ano

    KritikCVSS 9,1İstismar yokEPSS %15

    atlassian · jira service management1 Şub 2023

  • CVE-2023-23969
    44Planlayın

    In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avo

    YüksekCVSS 7,5İstismar yokEPSS %47

    djangoproject · django1 Şub 2023

  • CVE-2023-23074
    49Planlayın

    Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.

    OrtaCVSS 6,1İstismar yokEPSS %83

    zohocorp · manageengine servicedesk plus1 Şub 2023

  • CVE-2023-23076
    61Bu hafta

    OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.

    KritikCVSS 9,8İstismar yokEPSS %74

    zohocorp · manageengine supportcenter plus1 Şub 2023

  • CVE-2022-46552
    38İzleyin

    D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    dlink · dir-846 firmware2 Şub 2023

  • CVE-2023-25135
    46Planlayın

    vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers dese

    KritikCVSS 9,8Kavram kanıtıEPSS %23

    vbulletin · vbulletin3 Şub 2023

  • CVE-2023-25136
    53Planlayın

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.

    OrtaCVSS 6,5Kavram kanıtıEPSS %89

    openbsd · openssh3 Şub 2023

  • CVE-2023-0678
    32İzleyin

    Missing Authorization in phpipam/phpipam

    OrtaCVSS 5,3Kavram kanıtıEPSS %37

    phpipam · phpipam4 Şub 2023

  • CVE-2022-47071
    47Planlayın

    In NVS365 V01, the background network test function can trigger command execution.

    KritikCVSS 9,8İstismar yokEPSS %25

    nvs365 · nvs-365-v01 firmware6 Şub 2023

  • CVE-2023-0234
    40Planlayın

    SiteGround Security < 1.3.1 - Admin+ SQLi

    YüksekCVSS 8,8İstismar yokEPSS %17

    siteground · siteground security6 Şub 2023

  • CVE-2023-0669
    88Hemen

    Fortra GoAnywhere MFT License Response Servlet Command Injection

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %99

    fortra · goanywhere managed file transfer6 Şub 2023

  • CVE-2022-44267
    49Planlayın

    ImageMagick 7.1.0-49 is vulnerable to Denial of Service.

    OrtaCVSS 6,5Kavram kanıtıEPSS %76

    imagemagick · imagemagick6 Şub 2023

  • CVE-2022-44268
    53Planlayın

    ImageMagick 7.1.0-49 is vulnerable to Information Disclosure.

    OrtaCVSS 6,5Kavram kanıtıEPSS %89

    imagemagick · imagemagick6 Şub 2023

  • CVE-2023-23333
    69Bu hafta

    There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restricti

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    contec · solarview compact firmware6 Şub 2023

  • CVE-2022-3229
    60Bu hafta

    Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthen

    KritikCVSS 9,8SilahlaştırılmışEPSS %66

    unifiedremote · unified remote6 Şub 2023

  • CVE-2022-40224
    49Planlayın

    A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.

    YüksekCVSS 7,5İstismar yokEPSS %64

    moxa · sds-3008 firmware7 Şub 2023

  • CVE-2022-24990
    85Hemen

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/a

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %83

    terra-master · terramaster operating system7 Şub 2023

  • CVE-2023-25194
    64Bu hafta

    Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect

    YüksekCVSS 8,8SilahlaştırılmışEPSS %95

    apache · kafka connect7 Şub 2023

  • CVE-2022-45768
    44Planlayın

    Command Injection vulnerability in Edimax Technology Co., Ltd.

    YüksekCVSS 8,8İstismar yokEPSS %28

    edimax · br-6428ns firmware7 Şub 2023

  • CVE-2022-4304
    30İzleyin

    Timing Oracle in RSA Decryption

    OrtaCVSS 5,9Kavram kanıtıEPSS %23

    openssl · openssl8 Şub 2023

  • CVE-2022-4450
    39İzleyin

    Double free after calling PEM_read_bio_ex

    YüksekCVSS 7,5İstismar yokEPSS %28

    openssl · openssl8 Şub 2023

  • CVE-2023-0286
    50Planlayın

    X.400 address type confusion in X.509 GeneralName

    YüksekCVSS 7,4İstismar yokEPSS %71

    openssl · openssl8 Şub 2023

  • CVE-2023-21434
    28İzleyin

    Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching

    OrtaCVSS 6,1İstismar yokEPSS %12

    samsung · galaxy store9 Şub 2023

  • CVE-2023-24322
    34İzleyin

    A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arb

    OrtaCVSS 6,1Kavram kanıtıEPSS %31

    mojoportal · mojoportal9 Şub 2023

  • CVE-2022-45699
    62Bu hafta

    Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitr

    KritikCVSS 9,8Kavram kanıtıEPSS %76

    apsystems · ecu-r firmware9 Şub 2023

  • CVE-2022-46649
    36İzleyin

    Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary she

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    sierrawireless · aleos10 Şub 2023

  • CVE-2022-46650
    23İzleyin

    Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials

    OrtaCVSS 4,9İstismar yokEPSS %12

    sierrawireless · aleos10 Şub 2023

  • CVE-2023-0777
    44Planlayın

    Authentication Bypass by Primary Weakness in modoboa/modoboa

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    modoboa · modoboa10 Şub 2023

  • CVE-2022-48323
    56Planlayın

    Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    sunlogin · sunflower13 Şub 2023

  • CVE-2022-40022
    67Bu hafta

    Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.

    KritikCVSS 9,8SilahlaştırılmışEPSS %92

    microchip · syncserver s650 firmware13 Şub 2023

  • CVE-2022-4830
    41Planlayın

    Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode

    OrtaCVSS 5,4İstismar yokEPSS %65

    strangerstudios · paid memberships pro13 Şub 2023

  • CVE-2023-0159
    47Planlayın

    Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

    YüksekCVSS 7,5Kavram kanıtıEPSS %55

    wprealize · extensive vc addons for wpbakery page builder13 Şub 2023

  • CVE-2023-25717
    98Hemen

    Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    ruckuswireless · ruckus wireless admin13 Şub 2023

  • CVE-2023-0830
    27İzleyin

    EasyNAS backup.pl system os command injection

    OrtaCVSS 5,3Kavram kanıtıEPSS %20

    easynas · easynas14 Şub 2023

  • CVE-2023-21529
    83Hemen

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %59

    microsoft · exchange server14 Şub 2023

  • CVE-2023-21689
    47Planlayın

    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %26

    microsoft · windows 10 150714 Şub 2023

  • CVE-2023-21690
    47Planlayın

    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %27

    microsoft · windows 10 150714 Şub 2023

  • CVE-2023-21692
    45Planlayın

    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %21

    microsoft · windows 10 150714 Şub 2023

  • CVE-2023-21707
    60Bu hafta

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %82

    microsoft · exchange server14 Şub 2023

  • CVE-2023-21715
    63Bu hafta

    Microsoft Publisher Security Feature Bypass Vulnerability

    YüksekCVSS 7,3KEVSilahlaştırılmışEPSS %12

    microsoft · 365 apps14 Şub 2023

  • CVE-2023-21716
    64Bu hafta

    Microsoft Word Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %84

    microsoft · office14 Şub 2023

  • CVE-2023-21806
    32İzleyin

    Power BI Report Server Spoofing Vulnerability

    YüksekCVSS 8,2İstismar yokEPSS %0

    microsoft · power bi report server14 Şub 2023

  • CVE-2023-21818
    43Planlayın

    Windows Secure Channel Denial of Service Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %43

    microsoft · windows 1014 Şub 2023

  • CVE-2023-21819
    39İzleyin

    Windows Secure Channel Denial of Service Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %30

    microsoft · windows 10 180914 Şub 2023

  • CVE-2023-22629
    39İzleyin

    An issue was discovered in TitanFTP through 1.94.1205.

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    southrivertech · titan ftp server14 Şub 2023

  • CVE-2023-23376
    64Bu hafta

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %10

    microsoft · windows 10 150714 Şub 2023

  • CVE-2023-21823
    63Bu hafta

    Windows Graphics Component Remote Code Execution Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %5

    microsoft · windows 10 150714 Şub 2023

  • CVE-2023-24580
    49Planlayın

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.

    YüksekCVSS 7,5İstismar yokEPSS %62

    djangoproject · django14 Şub 2023

  • CVE-2023-25762
    45Planlayın

    Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Gener

    OrtaCVSS 5,4İstismar yokEPSS %81

    jenkins · pipeline\15 Şub 2023

  • CVE-2022-38111
    53Planlayın

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %84

    solarwinds · orion platform15 Şub 2023

  • CVE-2022-47503
    35İzleyin

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %24

    solarwinds · orion platform15 Şub 2023

  • CVE-2022-47504
    36İzleyin

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %25

    solarwinds · orion platform15 Şub 2023

  • CVE-2023-23836
    52Planlayın

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %80

    solarwinds · orion platform15 Şub 2023

  • CVE-2023-22855
    43Planlayın

    Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution.

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    kardex · kardex control center15 Şub 2023

  • CVE-2023-0861
    44Planlayın

    Authenticated Command Injection in NetModule NSRW

    YüksekCVSS 8,8Kavram kanıtıEPSS %28

    netmodule · netmodule router software16 Şub 2023

  • CVE-2023-22579
    35İzleyin

    Sequalize - Unsafe fall-through in getWhereConditions

    YüksekCVSS 8,8İstismar yokEPSS %0

    sequelizejs · sequelize16 Şub 2023

  • CVE-2023-23752
    81Hemen

    [20230201] - Core - Improper access check in webservice endpoints

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %99

    joomla · joomla\!16 Şub 2023

  • CVE-2021-42756
    49Planlayın

    Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    fortinet · fortiweb16 Şub 2023

  • CVE-2022-39952
    69Bu hafta

    A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11,

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    fortinet · fortinac16 Şub 2023

  • CVE-2023-24078
    51Planlayın

    Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cm

    YüksekCVSS 8,8Kavram kanıtıEPSS %52

    realtimelogic · fuguhub17 Şub 2023

  • CVE-2022-40032
    45Planlayın

    SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attacker

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    simple task managing system project · simple task managing system17 Şub 2023

  • CVE-2022-45701
    48Planlayın

    Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.

    YüksekCVSS 8,8Kavram kanıtıEPSS %42

    commscope · arris tg2482a firmware17 Şub 2023

  • CVE-2022-47986
    99Hemen

    IBM Aspera Faspex code execution

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    ibm · aspera faspex17 Şub 2023

  • CVE-2021-33391
    39İzleyin

    An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

    KritikCVSS 9,8İstismar yokEPSS %1

    htacg · tidy17 Şub 2023

  • CVE-2023-24329
    36İzleyin

    An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that start

    YüksekCVSS 7,5Kavram kanıtıEPSS %20

    python · python17 Şub 2023

  • CVE-2023-22232
    46Planlayın

    Adobe Connect Improper Access Control Security feature bypass

    OrtaCVSS 5,3Kavram kanıtıEPSS %83

    adobe · connect17 Şub 2023

  • CVE-2023-24998
    45Planlayın

    Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

    YüksekCVSS 7,5Kavram kanıtıEPSS %48

    apache · commons fileupload20 Şub 2023

  • CVE-2023-25157
    65Bu hafta

    Unfiltered SQL Injection Vulnerabilities in Geoserver

    KritikCVSS 9,8Kavram kanıtıEPSS %85

    osgeo · geoserver21 Şub 2023

  • CVE-2023-20858
    33İzleyin

    VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability.

    YüksekCVSS 7,2İstismar yokEPSS %16

    vmware · carbon black app control21 Şub 2023

  • CVE-2022-29273
    42Planlayın

    pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.

    OrtaCVSS 6,1İstismar yokEPSS %59

    netgate · pfsense22 Şub 2023

  • CVE-2023-0104
    38İzleyin

    The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file.

    YüksekCVSS 7,8İstismar yokEPSS %21

    weintek · easybuilder pro22 Şub 2023

  • CVE-2022-48343
    42Planlayın

    In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.

    OrtaCVSS 6,1İstismar yokEPSS %59

    jetbrains · teamcity23 Şub 2023

  • CVE-2023-0755
    43Planlayın

    The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remote

    KritikCVSS 9,8İstismar yokEPSS %11

    ge · digital industrial gateway server23 Şub 2023

  • CVE-2023-1009
    27İzleyin

    DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal

    OrtaCVSS 5,5İstismar yokEPSS %15

    draytek · vigor2960 firmware24 Şub 2023

  • CVE-2023-1034
    43Planlayın

    Path Traversal: '\..\filename' in salesagility/suitecrm

    YüksekCVSS 8,8İstismar yokEPSS %26

    salesagility · suitecrm24 Şub 2023

  • CVE-2023-26035
    63Bu hafta

    ZoneMinder vulnerable to Missing Authorization

    KritikCVSS 9,8SilahlaştırılmışEPSS %80

    zoneminder · zoneminder24 Şub 2023

  • CVE-2022-2024
    68Bu hafta

    OS Command Injection in gogs/gogs

    KritikCVSS 9,8İstismar yokEPSS %97

    gogs · gogs25 Şub 2023

  • CVE-2023-26602
    44Planlayın

    ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrat

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    asus · asmb8-ikvm firmware26 Şub 2023

  • CVE-2023-26609
    40Planlayın

    ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap

    YüksekCVSS 7,2Kavram kanıtıEPSS %38

    abus · tvip 20000-21150 firmware26 Şub 2023

  • CVE-2023-0552
    28İzleyin

    Pie Register < 3.8.2.3 - Open Redirect

    OrtaCVSS 5,4Kavram kanıtıEPSS %24

    genetechsolutions · pie register27 Şub 2023

  • CVE-2023-25234
    44Planlayın

    Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface.

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    tenda · ac500 firmware27 Şub 2023

  • CVE-2023-25235
    33İzleyin

    Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid.

    YüksekCVSS 7,5İstismar yokEPSS %11

    tenda · ac500 firmware27 Şub 2023

  • CVE-2022-22582
    27İzleyin

    A validation issue existed in the handling of symlinks.

    OrtaCVSS 5,5Kavram kanıtıEPSS %17

    apple · mac os x27 Şub 2023

  • CVE-2023-23529
    68Bu hafta

    A type confusion issue was addressed with improved checks.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %9

    apple · safari27 Şub 2023

  • CVE-2023-26255
    44Planlayın

    An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira.

    YüksekCVSS 7,5Kavram kanıtıEPSS %47

    stagil · stagil navigation28 Şub 2023

  • CVE-2023-26256
    33İzleyin

    An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    stagil · stagil navigation28 Şub 2023

  • CVE-2023-27293
    41Planlayın

    Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer

    OrtaCVSS 6,1İstismar yokEPSS %57

    opencats · opencats28 Şub 2023

  • CVE-2023-27372
    69Bu hafta

    SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    spip · spip28 Şub 2023

  • CVE-2022-47075
    48Planlayın

    An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name paramet

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    smartofficepayroll · smartoffice28 Şub 2023