İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2023: sömürülen ve yeni ciddi CVE kayıtları

82 kayıt · 18 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-27665
    34İzleyin

    Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0.

    OrtaCVSS 6,1Kavram kanıtıEPSS %33

    progress · ws ftp server3 Nis 2023

  • CVE-2022-43769
    87Hemen

    Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %97

    hitachi · vantara pentaho business analytics server3 Nis 2023

  • CVE-2022-43773
    42Planlayın

    Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource

    YüksekCVSS 8,8İstismar yokEPSS %22

    hitachi · vantara pentaho business analytics server3 Nis 2023

  • CVE-2022-43771
    33İzleyin

    Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    OrtaCVSS 6,5İstismar yokEPSS %23

    hitachi · vantara pentaho business analytics server3 Nis 2023

  • CVE-2022-43938
    43Planlayın

    Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

    YüksekCVSS 8,8İstismar yokEPSS %26

    hitachi · vantara pentaho business analytics server3 Nis 2023

  • CVE-2022-43939
    97Hemen

    Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %92

    hitachi · vantara pentaho business analytics server3 Nis 2023

  • CVE-2023-24724
    21İzleyin

    A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insuffic

    OrtaCVSS 5,4İstismar yokEPSS %0

    sas · web administration interface3 Nis 2023

  • CVE-2023-26976
    35İzleyin

    Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    tenda · ac6 firmware3 Nis 2023

  • CVE-2023-1671
    99Hemen

    A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    sophos · web appliance4 Nis 2023

  • CVE-2023-26750
    40Planlayın

    SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code vi

    KritikCVSS 9,8İstismar yokEPSS %1

    yiiframework · yii4 Nis 2023

  • CVE-2023-26775
    46Planlayın

    File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the asse

    YüksekCVSS 7,8İstismar yokEPSS %49

    monitorr · monitorr4 Nis 2023

  • CVE-2023-29374
    51Planlayın

    In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec met

    KritikCVSS 9,8İstismar yokEPSS %39

    langchain · langchain4 Nis 2023

  • CVE-2023-20073
    66Bu hafta

    Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %90

    cisco · rv340 firmware5 Nis 2023

  • CVE-2023-20128
    37İzleyin

    Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities

    YüksekCVSS 7,2İstismar yokEPSS %30

    cisco · rv320 firmware5 Nis 2023

  • CVE-2023-20117
    37İzleyin

    Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities

    YüksekCVSS 7,2İstismar yokEPSS %30

    cisco · rv320 firmware5 Nis 2023

  • CVE-2023-28342
    54Planlayın

    Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.

    YüksekCVSS 7,5İstismar yokEPSS %78

    zohocorp · manageengine adselfservice plus5 Nis 2023

  • CVE-2023-26083
    43Planlayın

    Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver a

    DüşükCVSS 3,3KEVSilahlaştırılmışEPSS %1

    arm · 5th gen gpu architecture kernel driver6 Nis 2023

  • CVE-2023-29017
    58Planlayın

    vm2 Sandbox Escape vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    vm2 project · vm26 Nis 2023

  • CVE-2023-0156
    25İzleyin

    All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

    OrtaCVSS 4,9Kavram kanıtıEPSS %19

    updraftplus · all-in-one security10 Nis 2023

  • CVE-2023-0157
    29İzleyin

    All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS

    OrtaCVSS 4,8Kavram kanıtıEPSS %32

    updraftplus · all-in-one security10 Nis 2023

  • CVE-2023-28205
    73Bu hafta

    A use after free issue was addressed with improved memory management.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %27

    apple · safari10 Nis 2023

  • CVE-2023-28206
    71Bu hafta

    An out-of-bounds write issue was addressed with improved input validation.

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %23

    apple · ipados10 Nis 2023

  • CVE-2023-26067
    43Planlayın

    Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).

    YüksekCVSS 8,1Kavram kanıtıEPSS %37

    lexmark · cxtpc firmware10 Nis 2023

  • CVE-2023-26068
    60Bu hafta

    Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).

    KritikCVSS 9,8SilahlaştırılmışEPSS %11

    lexmark · cxtpc firmware10 Nis 2023

  • CVE-2023-27076
    46Planlayın

    Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter.

    KritikCVSS 9,8İstismar yokEPSS %22

    tenda · g103 firmware10 Nis 2023

  • CVE-2023-28341
    54Planlayın

    Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to in

    OrtaCVSS 6,1İstismar yokEPSS %98

    zohocorp · manageengine applications manager10 Nis 2023

  • CVE-2023-27267
    36İzleyin

    Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)

    YüksekCVSS 8,1İstismar yokEPSS %14

    sap · diagnostics agent10 Nis 2023

  • CVE-2023-28765
    43Planlayın

    Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )

    KritikCVSS 9,8İstismar yokEPSS %14

    sap · businessobjects business intelligence10 Nis 2023

  • CVE-2023-29186
    33İzleyin

    Directory/Path Traversal vulnerability in SAP NetWeaver.

    OrtaCVSS 6,5İstismar yokEPSS %23

    sap · netweaver11 Nis 2023

  • CVE-2023-29492
    70Bu hafta

    Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %2

    3rdmill · novi survey11 Nis 2023

  • CVE-2023-27179
    48Planlayın

    GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdow

    YüksekCVSS 7,5Kavram kanıtıEPSS %60

    gdidees · gdidees cms11 Nis 2023

  • CVE-2023-21554
    68Bu hafta

    Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %95

    microsoft · windows 10 160711 Nis 2023

  • CVE-2023-21769
    57Planlayın

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %88

    microsoft · windows 10 160711 Nis 2023

  • CVE-2023-28218
    32İzleyin

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    YüksekCVSS 7,0Kavram kanıtıEPSS %12

    microsoft · windows 10 150711 Nis 2023

  • CVE-2023-28219
    36İzleyin

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %14

    microsoft · windows 10 150711 Nis 2023

  • CVE-2023-28220
    36İzleyin

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %14

    microsoft · windows 10 150711 Nis 2023

  • CVE-2023-28229
    59Planlayın

    Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %1

    microsoft · windows 10 150711 Nis 2023

  • CVE-2023-28231
    46Planlayın

    DHCP Server Service Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %36

    microsoft · windows server 200811 Nis 2023

  • CVE-2023-28252
    76Bu hafta

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %48

    microsoft · windows 10 150711 Nis 2023

  • CVE-2023-28302
    58Planlayın

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %92

    microsoft · windows 10 160711 Nis 2023

  • CVE-2023-27826
    39İzleyin

    SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection.

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    seowonintech · swc-5100w firmware12 Nis 2023

  • CVE-2023-28121
    65Bu hafta

    An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on beha

    KritikCVSS 9,8SilahlaştırılmışEPSS %87

    automattic · woocommerce payments12 Nis 2023

  • CVE-2023-20118
    74Bu hafta

    A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %54

    cisco · rv016 firmware13 Nis 2023

  • CVE-2023-29084
    57Planlayın

    Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.

    YüksekCVSS 7,2SilahlaştırılmışEPSS %98

    zohocorp · manageengine admanager plus13 Nis 2023

  • CVE-2023-2034
    56Planlayın

    Unrestricted Upload of File with Dangerous Type in froxlor/froxlor

    YüksekCVSS 8,8İstismar yokEPSS %71

    froxlor · froxlor13 Nis 2023

  • CVE-2023-29804
    40Planlayın

    WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function.

    YüksekCVSS 8,8İstismar yokEPSS %17

    iodata · wfs-sr03w firmware14 Nis 2023

  • CVE-2022-47501
    33İzleyin

    Apache OFBiz: Arbitrary file reading vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    apache · ofbiz14 Nis 2023

  • CVE-2023-2033
    77Bu hafta

    Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %40

    google · chrome14 Nis 2023

  • CVE-2022-38841
    38İzleyin

    Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute pa

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    linksys · e8450 firmware15 Nis 2023

  • CVE-2021-33990
    43Planlayın

    Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists.

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    liferay · liferay portal16 Nis 2023

  • CVE-2023-29509
    58Planlayın

    org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %75

    xwiki · xwiki16 Nis 2023

  • CVE-2023-30547
    62Bu hafta

    Sandbox Escape in vm2

    KritikCVSS 10,0Kavram kanıtıEPSS %72

    vm2 project · vm217 Nis 2023

  • CVE-2023-21931
    55Planlayın

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    YüksekCVSS 7,5Kavram kanıtıEPSS %82

    oracle · weblogic server18 Nis 2023

  • CVE-2023-21932
    41Planlayın

    Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI).

    YüksekCVSS 7,2İstismar yokEPSS %44

    oracle · hospitality opera 5 property services18 Nis 2023

  • CVE-2023-29516
    55Planlayın

    Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

    YüksekCVSS 8,8İstismar yokEPSS %65

    xwiki · xwiki18 Nis 2023

  • CVE-2023-29524
    58Planlayın

    Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform

    YüksekCVSS 8,8İstismar yokEPSS %75

    xwiki · xwiki18 Nis 2023

  • CVE-2023-29525
    58Planlayın

    Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

    YüksekCVSS 8,8İstismar yokEPSS %77

    xwiki · xwiki18 Nis 2023

  • CVE-2023-2136
    70Bu hafta

    Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to pote

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %5

    google · chrome19 Nis 2023

  • CVE-2023-22621
    49Planlayın

    Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the serve

    YüksekCVSS 7,2Kavram kanıtıEPSS %70

    strapi · strapi19 Nis 2023

  • CVE-2023-22894
    50Planlayın

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.

    OrtaCVSS 4,9KEVSilahlaştırılmışEPSS %3

    strapi · strapi19 Nis 2023

  • CVE-2023-27350
    99Hemen

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    papercut · papercut mf20 Nis 2023

  • CVE-2023-27351
    83Hemen

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %78

    papercut · papercut mf20 Nis 2023

  • CVE-2023-20864
    60Bu hafta

    VMware Aria Operations for Logs contains a deserialization vulnerability.

    KritikCVSS 9,8Kavram kanıtıEPSS %70

    vmware · aria operations for logs20 Nis 2023

  • CVE-2023-28458
    40Planlayın

    pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).

    OrtaCVSS 4,3SilahlaştırılmışEPSS %3

    pretalx · pretalx20 Nis 2023

  • CVE-2023-28459
    40Planlayın

    pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).

    OrtaCVSS 6,5SilahlaştırılmışEPSS %6

    pretalx · pretalx20 Nis 2023

  • CVE-2023-2227
    49Planlayın

    Improper Authorization in modoboa/modoboa

    KritikCVSS 9,1Kavram kanıtıEPSS %44

    modoboa · modoboa21 Nis 2023

  • CVE-2023-26876
    40Planlayın

    SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id pa

    YüksekCVSS 8,8SilahlaştırılmışEPSS %9

    piwigo · piwigo21 Nis 2023

  • CVE-2023-28131
    45Planlayın

    A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that confi

    KritikCVSS 9,6İstismar yokEPSS %23

    expo · expo software development kit24 Nis 2023

  • CVE-2023-27524
    98Hemen

    Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    apache · superset24 Nis 2023

  • CVE-2023-28771
    99Hemen

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    zyxel · atp100 firmware24 Nis 2023

  • CVE-2023-29552
    79Bu hafta

    The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %63

    netapp · smi-s provider25 Nis 2023

  • CVE-2021-23186
    34İzleyin

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and

    YüksekCVSS 8,7İstismar yokEPSS %0

    odoo · odoo25 Nis 2023

  • CVE-2021-44547
    36İzleyin

    A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading t

    KritikCVSS 9,1İstismar yokEPSS %0

    odoo · odoo25 Nis 2023

  • CVE-2023-25652
    46Planlayın

    "git apply --reject" partially-controlled arbitrary file write

    YüksekCVSS 7,5İstismar yokEPSS %51

    git-scm · git25 Nis 2023

  • CVE-2023-28769
    60Bu hafta

    The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.

    KritikCVSS 9,8SilahlaştırılmışEPSS %5

    zyxel · dx5401-b0 firmware27 Nis 2023

  • CVE-2023-28770
    60Bu hafta

    The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to

    YüksekCVSS 7,5SilahlaştırılmışEPSS %57

    zyxel · dx5401-b0 firmware27 Nis 2023

  • CVE-2023-25437
    39İzleyin

    An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive inf

    YüksekCVSS 8,8İstismar yokEPSS %14

    vtech · vcs754a firmware27 Nis 2023

  • CVE-2023-29489
    44Planlayın

    An issue was discovered in cPanel before 11.109.9999.116.

    OrtaCVSS 6,1Kavram kanıtıEPSS %65

    cpanel · cpanel27 Nis 2023

  • CVE-2023-28384
    48Planlayın

    mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system comman

    YüksekCVSS 8,8SilahlaştırılmışEPSS %44

    myscada · mypro27 Nis 2023

  • CVE-2023-28400
    42Planlayın

    mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system comman

    YüksekCVSS 8,8İstismar yokEPSS %24

    myscada · mypro27 Nis 2023

  • CVE-2023-28528
    40Planlayın

    IBM AIX command execution

    YüksekCVSS 7,8SilahlaştırılmışEPSS %1

    ibm · vios27 Nis 2023

  • CVE-2023-30405
    30İzleyin

    A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web sc

    OrtaCVSS 5,4İstismar yokEPSS %29

    aigital · wireless-n repeater mini router firmware28 Nis 2023