İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2023: sömürülen ve yeni ciddi CVE kayıtları

84 kayıt · 22 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2023-4708
    48Planlayın

    Infosoftbd Clcknshop GET Parameter all sql injection

    KritikCVSS 9,8Kavram kanıtıEPSS %31

    infosoftbd · clcknshop1 Eyl 2023

  • CVE-2023-39361
    66Bu hafta

    Unauthenticated SQL Injection in graph_view.php in Cacti

    KritikCVSS 9,8Kavram kanıtıEPSS %88

    cacti · cacti5 Eyl 2023

  • CVE-2023-39362
    54Planlayın

    Authenticated command injection in SNMP options of a Device

    YüksekCVSS 7,2Kavram kanıtıEPSS %85

    cacti · cacti5 Eyl 2023

  • CVE-2023-4762
    77Bu hafta

    Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %41

    google · chrome5 Eyl 2023

  • CVE-2023-35719
    34İzleyin

    ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

    OrtaCVSS 6,8İstismar yokEPSS %24

    zohocorp · manageengine adselfservice plus6 Eyl 2023

  • CVE-2023-4634
    65Bu hafta

    Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

    KritikCVSS 9,8Kavram kanıtıEPSS %85

    davidlingren · media library assistant6 Eyl 2023

  • CVE-2023-37941
    40Planlayın

    Apache Superset: Metadata db write access can lead to remote code execution

    OrtaCVSS 6,6SilahlaştırılmışEPSS %35

    apache · superset6 Eyl 2023

  • CVE-2023-39265
    60Bu hafta

    Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

    OrtaCVSS 6,5SilahlaştırılmışEPSS %86

    apache · superset6 Eyl 2023

  • CVE-2023-20238
    44Planlayın

    A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Se

    KritikCVSS 9,8İstismar yokEPSS %15

    cisco · broadworks application delivery platform6 Eyl 2023

  • CVE-2023-20269
    74Bu hafta

    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %25

    cisco · adaptive security appliance software6 Eyl 2023

  • CVE-2023-41061
    62Bu hafta

    A validation issue was addressed with improved logic.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %4

    apple · ipados7 Eyl 2023

  • CVE-2023-41064
    77Bu hafta

    A buffer overflow issue was addressed with improved memory handling.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %53

    apple · ipados7 Eyl 2023

  • CVE-2023-4528
    38İzleyin

    JSCAPE MFT Server Unsafe Deserialization on Management Port

    YüksekCVSS 7,2İstismar yokEPSS %31

    redwood · jscape mft7 Eyl 2023

  • CVE-2023-39584
    40Planlayın

    Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

    YüksekCVSS 7,5İstismar yokEPSS %34

    hexo · hexo8 Eyl 2023

  • CVE-2023-4873
    46Planlayın

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php os command injection

    KritikCVSS 9,8İstismar yokEPSS %22

    byzoro · smart s45f firmware9 Eyl 2023

  • CVE-2023-31068
    41Planlayın

    An issue was discovered in TSplus Remote Access through 16.0.2.14.

    KritikCVSS 9,8Kavram kanıtıEPSS %5

    tsplus · tsplus remote work11 Eyl 2023

  • CVE-2023-38743
    31İzleyin

    Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.

    YüksekCVSS 7,2Kavram kanıtıEPSS %11

    zohocorp · manageengine admanager plus11 Eyl 2023

  • CVE-2023-39780
    77Bu hafta

    On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %39

    asus · rt-ax55 firmware11 Eyl 2023

  • CVE-2023-35674
    62Bu hafta

    In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %2

    google · android11 Eyl 2023

  • CVE-2023-41990
    61Bu hafta

    The issue was addressed with improved handling of caches.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    apple · ipados11 Eyl 2023

  • CVE-2023-2071
    44Planlayın

    FactoryTalk View Machine Edition Vulnerable to Remote Code Execution

    KritikCVSS 9,8İstismar yokEPSS %17

    rockwellautomation · factorytalk view12 Eyl 2023

  • CVE-2023-4863
    95Hemen

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    google · chrome12 Eyl 2023

  • CVE-2023-36744
    49Planlayın

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,0İstismar yokEPSS %57

    microsoft · exchange server12 Eyl 2023

  • CVE-2023-36745
    56Planlayın

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,0Kavram kanıtıEPSS %79

    microsoft · exchange server12 Eyl 2023

  • CVE-2023-36756
    47Planlayın

    Microsoft Exchange Server Remote Code Execution Vulnerability

    YüksekCVSS 8,0İstismar yokEPSS %49

    microsoft · exchange server12 Eyl 2023

  • CVE-2023-36757
    43Planlayın

    Microsoft Exchange Server Spoofing Vulnerability

    YüksekCVSS 8,0İstismar yokEPSS %36

    microsoft · exchange server12 Eyl 2023

  • CVE-2023-36761
    62Bu hafta

    Microsoft Word Information Disclosure Vulnerability

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %19

    microsoft · 365 apps12 Eyl 2023

  • CVE-2023-36777
    38İzleyin

    Microsoft Exchange Server Information Disclosure Vulnerability

    OrtaCVSS 5,7İstismar yokEPSS %52

    microsoft · exchange server12 Eyl 2023

  • CVE-2023-36802
    69Bu hafta

    Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %27

    microsoft · windows 10 180912 Eyl 2023

  • CVE-2023-38146
    60Bu hafta

    Windows Themes Remote Code Execution Vulnerability

    YüksekCVSS 8,8SilahlaştırılmışEPSS %37

    microsoft · windows 11 21h212 Eyl 2023

  • CVE-2023-38152
    28İzleyin

    DHCP Server Service Information Disclosure Vulnerability

    OrtaCVSS 5,3İstismar yokEPSS %24

    microsoft · windows server 200812 Eyl 2023

  • CVE-2023-38162
    33İzleyin

    DHCP Server Service Denial of Service Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · windows server 201212 Eyl 2023

  • CVE-2023-3710
    54Planlayın

    Printer web page invalid command execution

    KritikCVSS 9,8Kavram kanıtıEPSS %49

    honeywell · pm43 firmware12 Eyl 2023

  • CVE-2023-26369
    63Bu hafta

    [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %6

    adobe · acrobat13 Eyl 2023

  • CVE-2023-41892
    67Bu hafta

    Craft CMS Remote Code Execution vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %94

    craftcms · craft cms13 Eyl 2023

  • CVE-2023-38204
    59Planlayın

    Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8

    KritikCVSS 9,8İstismar yokEPSS %66

    adobe · coldfusion14 Eyl 2023

  • CVE-2023-38205
    90Hemen

    ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    adobe · coldfusion14 Eyl 2023

  • CVE-2023-38039
    47Planlayın

    When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.

    YüksekCVSS 7,5Kavram kanıtıEPSS %58

    haxx · curl15 Eyl 2023

  • CVE-2023-32461
    26İzleyin

    Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.

    OrtaCVSS 6,7İstismar yokEPSS %0

    dell · poweredge r660 firmware15 Eyl 2023

  • CVE-2023-41887
    52Planlayın

    Remote Code exec in project import with mysql jdbc url attack

    KritikCVSS 9,8İstismar yokEPSS %42

    openrefine · openrefine15 Eyl 2023

  • CVE-2023-42442
    40Planlayın

    JumpServer session replays download without authentication

    OrtaCVSS 5,3Kavram kanıtıEPSS %63

    fit2cloud · jumpserver15 Eyl 2023

  • CVE-2023-33831
    47Planlayın

    A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    frangoteam · fuxa18 Eyl 2023

  • CVE-2023-41599
    25İzleyin

    An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.

    OrtaCVSS 5,3Kavram kanıtıEPSS %12

    jfinalcms project · jfinalcms18 Eyl 2023

  • CVE-2023-41179
    59Planlayın

    A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security an

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %4

    trendmicro · apex one19 Eyl 2023

  • CVE-2023-22513
    40Planlayın

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server.

    YüksekCVSS 8,8İstismar yokEPSS %15

    atlassian · bitbucket data center19 Eyl 2023

  • CVE-2023-42793
    99Hemen

    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    jetbrains · teamcity19 Eyl 2023

  • CVE-2023-40931
    30İzleyin

    A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrar

    OrtaCVSS 6,5Kavram kanıtıEPSS %11

    nagios · nagios xi19 Eyl 2023

  • CVE-2023-38886
    38İzleyin

    An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.

    YüksekCVSS 7,2İstismar yokEPSS %31

    dolibarr · dolibarr erp\/crm19 Eyl 2023

  • CVE-2023-43477
    40Planlayın

    Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)

    YüksekCVSS 8,8İstismar yokEPSS %17

    telstra · arcadyan lh1000 firmware20 Eyl 2023

  • CVE-2023-43478
    44Planlayın

    Unauthenticated configuration restore and firmware update

    KritikCVSS 9,8İstismar yokEPSS %17

    telstra · arcadyan lh1000 firmware20 Eyl 2023

  • CVE-2023-5074
    60Bu hafta

    Authentication Bypass in D-Link D-View 8

    KritikCVSS 9,8Kavram kanıtıEPSS %69

    dlink · d-view 820 Eyl 2023

  • CVE-2023-39677
    40Planlayın

    MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclo

    YüksekCVSS 7,5Kavram kanıtıEPSS %32

    myprestamodules · product catalog \(csv\, excel\) import20 Eyl 2023

  • CVE-2023-43237
    43Planlayın

    D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.

    KritikCVSS 9,8İstismar yokEPSS %13

    dlink · dir-816 a2 firmware21 Eyl 2023

  • CVE-2023-43239
    43Planlayın

    D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.

    KritikCVSS 9,8İstismar yokEPSS %13

    dlink · dir-816 a2 firmware21 Eyl 2023

  • CVE-2023-43240
    43Planlayın

    D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.

    KritikCVSS 9,8İstismar yokEPSS %13

    dlink · dir-816 a2 firmware21 Eyl 2023

  • CVE-2023-41991
    56Planlayın

    A certificate validation issue was addressed.

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %13

    apple · ipados21 Eyl 2023

  • CVE-2023-41992
    64Bu hafta

    The issue was addressed with improved checks.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %9

    apple · ipados21 Eyl 2023

  • CVE-2023-41993
    72Bu hafta

    The issue was addressed with improved checks.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %24

    apple · ipados21 Eyl 2023

  • CVE-2023-31719
    47Planlayın

    FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    frangoteam · fuxa21 Eyl 2023

  • CVE-2023-43770
    73Bu hafta

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %63

    roundcube · webmail22 Eyl 2023

  • CVE-2023-5145
    45Planlayın

    D-Link DAR-7000 licence.php unrestricted upload

    YüksekCVSS 8,8İstismar yokEPSS %34

    dlink · dar-7000 firmware24 Eyl 2023

  • CVE-2023-5146
    45Planlayın

    D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload

    YüksekCVSS 8,8İstismar yokEPSS %32

    dlink · dar-7000 firmware24 Eyl 2023

  • CVE-2023-5147
    43Planlayın

    D-Link DAR-7000 updateos.php unrestricted upload

    YüksekCVSS 8,8İstismar yokEPSS %26

    dlink · dar-7000 firmware24 Eyl 2023

  • CVE-2023-5148
    44Planlayın

    D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload

    YüksekCVSS 8,8İstismar yokEPSS %30

    dlink · dar-7000 firmware24 Eyl 2023

  • CVE-2023-5149
    41Planlayın

    D-Link DAR-7000 userattestation.php unrestricted upload

    YüksekCVSS 8,8İstismar yokEPSS %20

    dlink · dar-7000 firmware24 Eyl 2023

  • CVE-2023-5150
    42Planlayın

    D-Link DAR-7000/DAR-8000 web.php unrestricted upload

    YüksekCVSS 8,8İstismar yokEPSS %22

    dlink · dar-7000 firmware24 Eyl 2023

  • CVE-2023-5151
    59Planlayın

    D-Link DAR-8000 autheditpwd.php sql injection

    YüksekCVSS 8,8İstismar yokEPSS %80

    dlink · dar-8000 firmware24 Eyl 2023

  • CVE-2023-5154
    40Planlayın

    D-Link DAR-8000 changelogo.php unrestricted upload

    YüksekCVSS 8,8İstismar yokEPSS %15

    dlink · dar-8000 firmware24 Eyl 2023

  • CVE-2023-4521
    51Planlayın

    Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

    KritikCVSS 9,8Kavram kanıtıEPSS %40

    mooveagency · import xml and rss feeds25 Eyl 2023

  • CVE-2023-36851
    60Bu hafta

    Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %1

    juniper · junos27 Eyl 2023

  • CVE-2023-40044
    92Hemen

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %90

    progress · ws ftp server27 Eyl 2023

  • CVE-2023-41320
    50Planlayın

    Account takeover via SQL Injection in UI layout preferences in GLPI

    KritikCVSS 9,8İstismar yokEPSS %36

    glpi-project · glpi27 Eyl 2023

  • CVE-2023-41323
    31İzleyin

    Users login enumeration by unauthenticated user in GLPI

    OrtaCVSS 5,3İstismar yokEPSS %33

    glpi-project · glpi27 Eyl 2023

  • CVE-2023-41326
    46Planlayın

    Account takeover via Kanban feature in GLPI

    YüksekCVSS 8,8İstismar yokEPSS %36

    glpi-project · glpi27 Eyl 2023

  • CVE-2023-42657
    43Planlayın

    WS_FTP Server Directory Traversal

    KritikCVSS 9,6İstismar yokEPSS %16

    progress · ws ftp server27 Eyl 2023

  • CVE-2023-43187
    53Planlayın

    A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers

    KritikCVSS 9,8Kavram kanıtıEPSS %47

    nodebb · nodebb27 Eyl 2023

  • CVE-2023-44018
    44Planlayın

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain parameter in the add_whi

    KritikCVSS 9,8İstismar yokEPSS %15

    tendacn · ac10u firmware27 Eyl 2023

  • CVE-2023-5222
    63Bu hafta

    Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password

    KritikCVSS 9,8Kavram kanıtıEPSS %80

    viessmann · vitogate 300 firmware27 Eyl 2023

  • CVE-2023-20109
    57Planlayın

    A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an

    OrtaCVSS 6,6KEVSilahlaştırılmışEPSS %2

    cisco · ios27 Eyl 2023

  • CVE-2023-38874
    44Planlayın

    A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April

    YüksekCVSS 8,8İstismar yokEPSS %31

    economizzer · economizzer28 Eyl 2023

  • CVE-2023-5217
    80Hemen

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to poten

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %49

    google · chrome28 Eyl 2023

  • CVE-2023-43654
    60Bu hafta

    TorchServe Server-Side Request Forgery

    KritikCVSS 9,8SilahlaştırılmışEPSS %41

    pytorch · torchserve28 Eyl 2023

  • CVE-2023-30591
    48Planlayın

    NodeBB Pre-Authentication Denial-of-Service

    YüksekCVSS 7,5İstismar yokEPSS %58

    nodebb · nodebb29 Eyl 2023

  • CVE-2023-44466
    49Planlayın

    An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5.

    YüksekCVSS 8,8İstismar yokEPSS %45

    linux · linux kernel29 Eyl 2023