İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2023: sömürülen ve yeni ciddi CVE kayıtları

68 kayıt · 15 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2023-26258
    51Planlayın

    Arcserve UDP through 9.0.6034 allows authentication bypass.

    KritikCVSS 9,8Kavram kanıtıEPSS %39

    arcserve · udp3 Tem 2023

  • CVE-2023-3460
    61Bu hafta

    Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

    KritikCVSS 9,8Kavram kanıtıEPSS %72

    ultimatemember · ultimate member4 Tem 2023

  • CVE-2023-36932
    56Planlayın

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023

    YüksekCVSS 8,1İstismar yokEPSS %81

    progress · moveit transfer5 Tem 2023

  • CVE-2023-36933
    52Planlayın

    In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is

    YüksekCVSS 7,5İstismar yokEPSS %72

    progress · moveit transfer5 Tem 2023

  • CVE-2023-36934
    65Bu hafta

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023

    KritikCVSS 9,1Kavram kanıtıEPSS %95

    progress · moveit transfer5 Tem 2023

  • CVE-2023-35924
    55Planlayın

    GLPI vulnerable to SQL injection via inventory agent request

    KritikCVSS 9,8İstismar yokEPSS %52

    glpi-project · glpi5 Tem 2023

  • CVE-2023-36808
    55Planlayın

    GLPI vulnerable to SQL injection through Computer Virtual Machine information

    KritikCVSS 9,8Kavram kanıtıEPSS %51

    glpi-project · glpi5 Tem 2023

  • CVE-2023-36969
    50Planlayın

    CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %49

    cmsmadesimple · cms made simple6 Tem 2023

  • CVE-2023-34192
    89Hemen

    Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted scr

    KritikCVSS 9,0KEVSilahlaştırılmışEPSS %77

    synacor · zimbra collaboration suite6 Tem 2023

  • CVE-2023-34193
    35İzleyin

    File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive inform

    YüksekCVSS 8,8İstismar yokEPSS %1

    zimbra · collaboration6 Tem 2023

  • CVE-2023-36460
    51Planlayın

    Mastodon vulnerable to arbitrary file creation through media attachments

    KritikCVSS 9,9İstismar yokEPSS %40

    joinmastodon · mastodon6 Tem 2023

  • CVE-2023-1183
    41Planlayın

    Arbitrary file write

    OrtaCVSS 5,5İstismar yokEPSS %64

    libreoffice · libreoffice10 Tem 2023

  • CVE-2023-2796
    34İzleyin

    EventON < 2.1.2 - Unauthenticated Event Access

    OrtaCVSS 5,3Kavram kanıtıEPSS %42

    myeventon · eventon10 Tem 2023

  • CVE-2023-24488
    48Planlayın

    Cross site scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %80

    citrix · gateway10 Tem 2023

  • CVE-2023-24489
    98Hemen

    A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthent

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    citrix · sharefile storage zones controller10 Tem 2023

  • CVE-2023-3608
    39İzleyin

    Ruijie BCR810W Tracert Page os command injection

    YüksekCVSS 8,8İstismar yokEPSS %12

    ruijienetworks · bcr810w firmware10 Tem 2023

  • CVE-2023-36824
    58Planlayın

    Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis

    YüksekCVSS 8,8İstismar yokEPSS %77

    redis · redis11 Tem 2023

  • CVE-2023-32046
    64Bu hafta

    Windows MSHTML Platform Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %10

    microsoft · windows 10 150711 Tem 2023

  • CVE-2023-32049
    66Bu hafta

    Windows SmartScreen Security Feature Bypass Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %4

    microsoft · windows 10 160711 Tem 2023

  • CVE-2023-33157
    46Planlayın

    Microsoft SharePoint Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %38

    microsoft · sharepoint server11 Tem 2023

  • CVE-2023-36874
    74Bu hafta

    Windows Error Reporting Service Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %42

    microsoft · windows 10 150711 Tem 2023

  • CVE-2023-36884
    90Hemen

    Windows Search Remote Code Execution Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %98

    microsoft · windows 10 150711 Tem 2023

  • CVE-2023-35311
    70Bu hafta

    Microsoft Outlook Security Feature Bypass Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %15

    microsoft · 365 apps11 Tem 2023

  • CVE-2023-37582
    66Bu hafta

    Apache RocketMQ: Possible remote code execution when using the update configuration function

    KritikCVSS 9,8Kavram kanıtıEPSS %90

    apache · rocketmq12 Tem 2023

  • CVE-2023-29298
    90Hemen

    Adobe ColdFusion Improper Access Control Security feature bypass

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    adobe · coldfusion12 Tem 2023

  • CVE-2023-29300
    99Hemen

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    adobe · coldfusion12 Tem 2023

  • CVE-2023-29301
    40Planlayın

    Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass

    YüksekCVSS 7,5İstismar yokEPSS %34

    adobe · coldfusion12 Tem 2023

  • CVE-2023-37629
    46Planlayın

    Online Piggery Management System 1.0 is vulnerable to File Upload.

    KritikCVSS 9,8Kavram kanıtıEPSS %23

    simple online piggery management system project · simple online piggery management system12 Tem 2023

  • CVE-2023-3643
    62Bu hafta

    Boss Mini document file inclusion

    KritikCVSS 9,8Kavram kanıtıEPSS %75

    carel · boss mini firmware12 Tem 2023

  • CVE-2023-34124
    60Bu hafta

    The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass.

    KritikCVSS 9,8SilahlaştırılmışEPSS %50

    sonicwall · analytics12 Tem 2023

  • CVE-2023-34125
    33İzleyin

    Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem wi

    OrtaCVSS 6,5İstismar yokEPSS %23

    sonicwall · analytics12 Tem 2023

  • CVE-2023-34127
    61Bu hafta

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analyti

    YüksekCVSS 8,8SilahlaştırılmışEPSS %85

    sonicwall · analytics12 Tem 2023

  • CVE-2023-34129
    47Planlayın

    Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authen

    YüksekCVSS 8,8İstismar yokEPSS %41

    sonicwall · analytics12 Tem 2023

  • CVE-2023-34132
    60Bu hafta

    Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks.

    KritikCVSS 9,8SilahlaştırılmışEPSS %7

    sonicwall · analytics12 Tem 2023

  • CVE-2023-34133
    60Bu hafta

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an

    YüksekCVSS 7,5SilahlaştırılmışEPSS %72

    sonicwall · analytics12 Tem 2023

  • CVE-2023-29452
    40Planlayın

    Remove possibility to add html into Geomap attribution field

    OrtaCVSS 5,4İstismar yokEPSS %64

    zabbix · zabbix13 Tem 2023

  • CVE-2022-24834
    47Planlayın

    Heap overflow issue with the Lua cjson library used by Redis

    YüksekCVSS 8,8Kavram kanıtıEPSS %41

    redis · redis13 Tem 2023

  • CVE-2023-37474
    43Planlayın

    Path traversal in copyparty

    YüksekCVSS 7,5Kavram kanıtıEPSS %44

    9001 · copyparty14 Tem 2023

  • CVE-2023-37462
    62Bu hafta

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui

    YüksekCVSS 8,8Kavram kanıtıEPSS %91

    xwiki · xwiki14 Tem 2023

  • CVE-2023-33012
    40Planlayın

    A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX

    YüksekCVSS 8,8SilahlaştırılmışEPSS %9

    zyxel · usg 20w-vpn firmware17 Tem 2023

  • CVE-2023-37791
    43Planlayın

    D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.

    KritikCVSS 9,8İstismar yokEPSS %12

    dlink · dir-619l firmware17 Tem 2023

  • CVE-2021-4428
    35İzleyin

    what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    what3words · autosuggest18 Tem 2023

  • CVE-2023-22047
    53Planlayın

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).

    YüksekCVSS 7,5Kavram kanıtıEPSS %76

    oracle · peoplesoft enterprise18 Tem 2023

  • CVE-2023-3765
    60Bu hafta

    Absolute Path Traversal in mlflow/mlflow

    KritikCVSS 10,0Kavram kanıtıEPSS %67

    lfprojects · mlflow18 Tem 2023

  • CVE-2023-3519
    99Hemen

    Unauthenticated remote code execution

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    citrix · netscaler application delivery controller19 Tem 2023

  • CVE-2023-38408
    63Bu hafta

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if

    KritikCVSS 9,8Kavram kanıtıEPSS %79

    openbsd · openssh20 Tem 2023

  • CVE-2023-34966
    49Planlayın

    Samba: infinite loop in mdssvc rpc service for spotlight

    YüksekCVSS 7,5İstismar yokEPSS %62

    samba · samba20 Tem 2023

  • CVE-2023-34967
    39İzleyin

    Samba: type confusion in mdssvc rpc service for spotlight

    OrtaCVSS 5,3İstismar yokEPSS %61

    samba · samba20 Tem 2023

  • CVE-2023-38203
    98Hemen

    Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    adobe · coldfusion20 Tem 2023

  • CVE-2023-37645
    28İzleyin

    eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.

    OrtaCVSS 5,3Kavram kanıtıEPSS %24

    eyoucms · eyoucms20 Tem 2023

  • CVE-2023-35086
    40Planlayın

    ASUS RT-AX56U V2 & RT-AC86U - Format String -1

    YüksekCVSS 7,2Kavram kanıtıEPSS %38

    asus · rt-ac86u firmware21 Tem 2023

  • CVE-2023-38646
    69Bu hafta

    Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at

    KritikCVSS 9,8SilahlaştırılmışEPSS %98

    metabase · metabase21 Tem 2023

  • CVE-2023-3836
    61Bu hafta

    Dahua Smart Park Management unrestricted upload

    KritikCVSS 9,8Kavram kanıtıEPSS %73

    dahuasecurity · smart parking management22 Tem 2023

  • CVE-2023-3852
    36İzleyin

    OpenRapid RapidCMS upload.php unrestricted upload

    YüksekCVSS 7,2İstismar yokEPSS %25

    openrapid · rapidcms23 Tem 2023

  • CVE-2023-35078
    99Hemen

    An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appli

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    ivanti · endpoint manager mobile25 Tem 2023

  • CVE-2023-3486
    54Planlayın

    PaperCut NG Unauthenticated File Upload

    YüksekCVSS 7,5İstismar yokEPSS %79

    papercut · papercut mf25 Tem 2023

  • CVE-2023-2640
    40Planlayın

    On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unp

    YüksekCVSS 7,8SilahlaştırılmışEPSS %15

    canonical · ubuntu linux25 Tem 2023

  • CVE-2023-32629
    40Planlayın

    Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_

    YüksekCVSS 7,8SilahlaştırılmışEPSS %9

    canonical · ubuntu linux25 Tem 2023

  • CVE-2023-28130
    34İzleyin

    Local user may lead to privilege escalation using Gaia Portal hostnames page.

    YüksekCVSS 7,2İstismar yokEPSS %20

    checkpoint · gaia portal26 Tem 2023

  • CVE-2023-31465
    53Planlayın

    An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28.

    KritikCVSS 9,8Kavram kanıtıEPSS %46

    fsmlabs · timekeeper26 Tem 2023

  • CVE-2023-37450
    71Bu hafta

    The issue was addressed with improved checks.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %18

    apple · safari26 Tem 2023

  • CVE-2023-38606
    53Planlayın

    This issue was addressed with improved state management.

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %2

    apple · ipados26 Tem 2023

  • CVE-2023-37754
    48Planlayın

    PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.

    KritikCVSS 9,8İstismar yokEPSS %30

    powerjob · powerjob28 Tem 2023

  • CVE-2023-38992
    61Bu hafta

    jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.

    KritikCVSS 9,8Kavram kanıtıEPSS %73

    jeecg · jeecg boot28 Tem 2023

  • CVE-2022-4906
    39İzleyin

    Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via

    YüksekCVSS 8,8İstismar yokEPSS %12

    google · chrome28 Tem 2023

  • CVE-2023-37580
    69Bu hafta

    Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %49

    synacor · zimbra collaboration suite31 Tem 2023

  • CVE-2023-3983
    40Planlayın

    An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752.

    YüksekCVSS 8,8İstismar yokEPSS %16

    advantech · iview31 Tem 2023

  • CVE-2023-34960
    69Bu hafta

    A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary comm

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    chamilo · chamilo31 Tem 2023