İçeriğe atla
Noroxi

Yayın tarihine göre

Ağustos 2023: sömürülen ve yeni ciddi CVE kayıtları

87 kayıt · 14 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2022-39986
    69Bu hafta

    A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id p

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    raspap · raspap1 Ağu 2023

  • CVE-2022-39987
    46Planlayın

    A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via t

    YüksekCVSS 8,8İstismar yokEPSS %37

    raspap · raspap1 Ağu 2023

  • CVE-2023-34634
    40Planlayın

    Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %7

    getgreenshot · greenshot1 Ağu 2023

  • CVE-2023-36210
    48Planlayın

    MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keywor

    KritikCVSS 9,8İstismar yokEPSS %30

    motocms · motocms1 Ağu 2023

  • CVE-2023-4050
    34İzleyin

    In some cases, an untrusted input stream was copied to a stack buffer without checking its size.

    YüksekCVSS 7,5İstismar yokEPSS %12

    mozilla · firefox1 Ağu 2023

  • CVE-2023-2164
    41Planlayın

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    OrtaCVSS 5,4İstismar yokEPSS %66

    gitlab · gitlab1 Ağu 2023

  • CVE-2023-3364
    43Planlayın

    Inefficient Regular Expression Complexity in GitLab

    YüksekCVSS 7,5İstismar yokEPSS %44

    gitlab · gitlab1 Ağu 2023

  • CVE-2023-4068
    37İzleyin

    Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML p

    YüksekCVSS 8,1İstismar yokEPSS %16

    google · chrome2 Ağu 2023

  • CVE-2023-4069
    42Planlayın

    Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8İstismar yokEPSS %24

    google · chrome2 Ağu 2023

  • CVE-2023-36212
    43Planlayın

    File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page fu

    YüksekCVSS 8,8İstismar yokEPSS %25

    totalcms · total cms2 Ağu 2023

  • CVE-2023-36255
    51Planlayın

    An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path

    YüksekCVSS 8,8SilahlaştırılmışEPSS %53

    eramba · eramba2 Ağu 2023

  • CVE-2023-37679
    69Bu hafta

    A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    nextgen · mirth connect2 Ağu 2023

  • CVE-2023-4120
    58Planlayın

    Byzoro Smart S85F Management Platform importhtml.php command injection

    KritikCVSS 9,8İstismar yokEPSS %62

    byzoro · smart s85f3 Ağu 2023

  • CVE-2023-35081
    77Bu hafta

    A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticat

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %63

    ivanti · endpoint manager mobile3 Ağu 2023

  • CVE-2023-38950
    88Hemen

    A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via suppl

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %92

    zkteco · biotime3 Ağu 2023

  • CVE-2023-29689
    55Planlayın

    PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw.

    KritikCVSS 9,8Kavram kanıtıEPSS %53

    pyrocms · pyrocms4 Ağu 2023

  • CVE-2023-39143
    63Bu hafta

    PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files.

    KritikCVSS 9,8Kavram kanıtıEPSS %80

    papercut · papercut mf4 Ağu 2023

  • CVE-2023-4165
    43Planlayın

    Tongda OA delete_seal.php sql injection

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    tongda2000 · tongda office anywhere5 Ağu 2023

  • CVE-2023-4166
    43Planlayın

    Tongda OA delete_log.php sql injection

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    tongda2000 · tongda office anywhere5 Ağu 2023

  • CVE-2023-4168
    44Planlayın

    Templatecookie Adlisting Redirect ad-list information disclosure

    YüksekCVSS 7,5Kavram kanıtıEPSS %45

    templatecookie · adlisting5 Ağu 2023

  • CVE-2023-4169
    50Planlayın

    Ruijie RG-EW1200G Administrator Password set_passwd access control

    YüksekCVSS 8,8Kavram kanıtıEPSS %49

    ruijie · rg-ew1200g firmware5 Ağu 2023

  • CVE-2023-4174
    27İzleyin

    mooSocial mooStore cross site scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %9

    moosocial · moostore5 Ağu 2023

  • CVE-2023-38925
    40Planlayın

    Netgear DC112A 1.0.0.64, EX6200 1.0.3.94 and R6300v2 1.0.4.8 were discovered to contain a buffer overflow via the http_passwd parameter in p

    YüksekCVSS 8,8İstismar yokEPSS %15

    netgear · dc112a firmware7 Ağu 2023

  • CVE-2023-37569
    45Planlayın

    OS Command Injection Vulnerability in Emagic Data Center Management Suite

    YüksekCVSS 8,8Kavram kanıtıEPSS %33

    esds.co · emagic data center management8 Ağu 2023

  • CVE-2023-20588
    25İzleyin

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.

    OrtaCVSS 5,5İstismar yokEPSS %11

    amd · epyc 7351p firmware8 Ağu 2023

  • CVE-2023-36900
    34İzleyin

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %10

    microsoft · windows 108 Ağu 2023

  • CVE-2023-38181
    38İzleyin

    Microsoft Exchange Server Spoofing Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %10

    microsoft · exchange server8 Ağu 2023

  • CVE-2023-36899
    58Planlayın

    ASP.NET Elevation of Privilege Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %76

    microsoft · .net framework8 Ağu 2023

  • CVE-2023-38180
    64Bu hafta

    .NET and Visual Studio Denial of Service Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %14

    microsoft · .net8 Ağu 2023

  • CVE-2023-32781
    40Planlayın

    A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user wit

    YüksekCVSS 7,2SilahlaştırılmışEPSS %14

    paessler · prtg network monitor9 Ağu 2023

  • CVE-2023-32782
    45Planlayın

    A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with wri

    YüksekCVSS 7,2İstismar yokEPSS %56

    paessler · prtg network monitor9 Ağu 2023

  • CVE-2023-30699
    39İzleyin

    Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remot

    KritikCVSS 9,8İstismar yokEPSS %0

    samsung · android9 Ağu 2023

  • CVE-2023-35085
    39İzleyin

    An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    ui · unifi uap firmware10 Ağu 2023

  • CVE-2023-38034
    39İzleyin

    A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could

    KritikCVSS 9,8İstismar yokEPSS %1

    ui · unifi uap firmware10 Ağu 2023

  • CVE-2023-32560
    69Bu hafta

    An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary co

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    ivanti · avalanche10 Ağu 2023

  • CVE-2023-32562
    53Planlayın

    An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t

    KritikCVSS 9,8İstismar yokEPSS %45

    ivanti · avalanche10 Ağu 2023

  • CVE-2023-32563
    66Bu hafta

    An unauthenticated attacker could achieve the code execution through a RemoteControl server.

    KritikCVSS 9,8Kavram kanıtıEPSS %89

    ivanti · avalanche10 Ağu 2023

  • CVE-2023-32564
    52Planlayın

    An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t

    KritikCVSS 9,8İstismar yokEPSS %44

    ivanti · avalanche10 Ağu 2023

  • CVE-2023-3824
    46Planlayın

    Buffer overflow and overread in phar_dir_read()

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    php · php11 Ağu 2023

  • CVE-2023-40303
    31İzleyin

    GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin

    YüksekCVSS 7,8İstismar yokEPSS %0

    gnu · inetutils14 Ağu 2023

  • CVE-2023-0872
    40Planlayın

    ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

    YüksekCVSS 8,0SilahlaştırılmışEPSS %3

    opennms · horizon14 Ağu 2023

  • CVE-2023-29468
    42Planlayın

    The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_E

    KritikCVSS 9,8İstismar yokEPSS %10

    ti · wilink8-wifi-mcp814 Ağu 2023

  • CVE-2022-48503
    66Bu hafta

    The issue was addressed with improved bounds checks.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %3

    apple · safari14 Ağu 2023

  • CVE-2023-4347
    42Planlayın

    Cross-site Scripting (XSS) - Reflected in librenms/librenms

    OrtaCVSS 5,4İstismar yokEPSS %69

    librenms · librenms14 Ağu 2023

  • CVE-2023-2916
    28İzleyin

    InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %23

    revmakx · infinitewp client15 Ağu 2023

  • CVE-2023-35082
    99Hemen

    An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resou

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    ivanti · endpoint manager mobile15 Ağu 2023

  • CVE-2023-40028
    47Planlayın

    Arbitrary file read via symlinks in Ghost

    OrtaCVSS 6,5Kavram kanıtıEPSS %68

    ghost · ghost15 Ağu 2023

  • CVE-2023-4355
    43Planlayın

    Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption v

    YüksekCVSS 8,8İstismar yokEPSS %27

    google · chrome15 Ağu 2023

  • CVE-2023-4357
    49Planlayın

    Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access re

    YüksekCVSS 8,8Kavram kanıtıEPSS %47

    google · chrome15 Ağu 2023

  • CVE-2023-4362
    41Planlayın

    Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process

    YüksekCVSS 8,8İstismar yokEPSS %19

    google · chrome15 Ağu 2023

  • CVE-2023-20209
    40Planlayın

    A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) cou

    YüksekCVSS 7,2Kavram kanıtıEPSS %40

    cisco · telepresence video communication server16 Ağu 2023

  • CVE-2023-2914
    42Planlayın

    Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerabilitiy

    YüksekCVSS 7,5İstismar yokEPSS %39

    rockwellautomation · thinmanager thinserver17 Ağu 2023

  • CVE-2023-2915
    61Bu hafta

    Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

    KritikCVSS 9,1SilahlaştırılmışEPSS %81

    rockwellautomation · thinmanager thinserver17 Ağu 2023

  • CVE-2023-2917
    61Bu hafta

    Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %72

    rockwellautomation · thinmanager thinserver17 Ağu 2023

  • CVE-2023-26469
    64Bu hafta

    In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.

    KritikCVSS 9,8SilahlaştırılmışEPSS %82

    jorani · jorani17 Ağu 2023

  • CVE-2023-40313
    35İzleyin

    Disable BeanShell Interpreter Remote Server Mode

    YüksekCVSS 8,8İstismar yokEPSS %0

    opennms · horizon17 Ağu 2023

  • CVE-2023-36844
    78Bu hafta

    Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %89

    juniper · junos17 Ağu 2023

  • CVE-2023-36845
    98Hemen

    Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95

    juniper · junos17 Ağu 2023

  • CVE-2023-36846
    79Bu hafta

    Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %93

    juniper · junos17 Ağu 2023

  • CVE-2023-36847
    76Bu hafta

    Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %83

    juniper · junos17 Ağu 2023

  • CVE-2023-40315
    40Planlayın

    ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN

    YüksekCVSS 8,0SilahlaştırılmışEPSS %2

    opennms · horizon17 Ağu 2023

  • CVE-2023-4415
    52Planlayın

    Ruijie RG-EW1200G login improper authentication

    YüksekCVSS 8,8Kavram kanıtıEPSS %58

    ruijienetworks · rg-ew1200g firmware18 Ağu 2023

  • CVE-2022-24989
    60Bu hafta

    TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for

    KritikCVSS 9,8SilahlaştırılmışEPSS %31

    terra-master · terramaster operating system20 Ağu 2023

  • CVE-2023-39750
    43Planlayın

    D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6.

    KritikCVSS 9,8İstismar yokEPSS %14

    dlink · dap-2660 firmware20 Ağu 2023

  • CVE-2023-4450
    42Planlayın

    jeecgboot JimuReport Template injection

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    jeecg · jimureport20 Ağu 2023

  • CVE-2023-38035
    99Hemen

    A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass a

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    ivanti · mobileiron sentry21 Ağu 2023

  • CVE-2023-38836
    58Planlayın

    File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type c

    YüksekCVSS 8,8SilahlaştırılmışEPSS %76

    boidcms · boidcms21 Ağu 2023

  • CVE-2023-37435
    26İzleyin

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    OrtaCVSS 6,5İstismar yokEPSS %0

    arubanetworks · edgeconnect sd-wan orchestrator22 Ağu 2023

  • CVE-2023-37440
    21İzleyin

    Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure

    OrtaCVSS 5,3İstismar yokEPSS %0

    arubanetworks · edgeconnect sd-wan orchestrator22 Ağu 2023

  • CVE-2023-39026
    35İzleyin

    Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive i

    YüksekCVSS 7,5Kavram kanıtıEPSS %17

    filemage · filemage22 Ağu 2023

  • CVE-2023-4427
    47Planlayın

    Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read

    YüksekCVSS 8,1Kavram kanıtıEPSS %48

    google · chrome22 Ağu 2023

  • CVE-2023-4428
    35İzleyin

    Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory rea

    YüksekCVSS 8,1İstismar yokEPSS %11

    google · chrome22 Ağu 2023

  • CVE-2023-38831
    91Hemen

    RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %99

    rarlab · winrar23 Ağu 2023

  • CVE-2023-40176
    45Planlayın

    SXSS in the user profile via the timezone displayer

    OrtaCVSS 5,4İstismar yokEPSS %79

    xwiki · xwiki23 Ağu 2023

  • CVE-2023-41249
    41Planlayın

    In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step

    OrtaCVSS 6,1İstismar yokEPSS %55

    jetbrains · teamcity25 Ağu 2023

  • CVE-2023-4542
    64Bu hafta

    D-Link DAR-8000-10 sys1.php os command injection

    KritikCVSS 9,8Kavram kanıtıEPSS %84

    dlink · dar-8000-10 firmware25 Ağu 2023

  • CVE-2023-4547
    26İzleyin

    SPA-Cart eCommerce CMS search cross site scripting

    DüşükCVSS 2,0Kavram kanıtıEPSS %60

    spa-cart · ecommerce cms26 Ağu 2023

  • CVE-2023-4548
    18İzleyin

    SPA-Cart eCommerce CMS GET Parameter search sql injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %32

    spa-cart · ecommerce cms26 Ağu 2023

  • CVE-2023-41109
    58Planlayın

    SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    patton · smartnode sn200 firmware28 Ağu 2023

  • CVE-2023-40787
    44Planlayın

    In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL

    KritikCVSS 9,8İstismar yokEPSS %18

    bladex · springblade29 Ağu 2023

  • CVE-2023-20890
    34İzleyin

    Aria Operations for Networks contains an arbitrary file write vulnerability.

    YüksekCVSS 7,2İstismar yokEPSS %20

    vmware · aria operations for networks29 Ağu 2023

  • CVE-2023-34039
    60Bu hafta

    Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.

    KritikCVSS 9,8SilahlaştırılmışEPSS %67

    vmware · aria operations for networks29 Ağu 2023

  • CVE-2023-4346
    60Bu hafta

    KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %1

    knx · connection authorization29 Ağu 2023

  • CVE-2023-41265
    95Hemen

    An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023

    KritikCVSS 9,9KEVSilahlaştırılmışEPSS %88

    qlik · qlik sense29 Ağu 2023

  • CVE-2023-41266
    81Hemen

    A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %84

    qlik · qlik sense29 Ağu 2023

  • CVE-2023-4596
    43Planlayın

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    incsub · forminator29 Ağu 2023

  • CVE-2023-4481
    36İzleyin

    Junos OS and Junos OS Evolved: A crafted BGP UPDATE message allows a remote attacker to de-peer (reset) BGP sessions (CVE-2023-4481)

    YüksekCVSS 7,5İstismar yokEPSS %18

    juniper · junos31 Ağu 2023