İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2023: sömürülen ve yeni ciddi CVE kayıtları

169 kayıt · 11 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2023-6038
    31İzleyin

    Local File Inclusion in h2oai/h2o-3

    YüksekCVSS 7,5Kavram kanıtıEPSS %4

    h2o · h2o16 Kas 2023

  • CVE-2023-46214
    62Bu hafta

    Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

    YüksekCVSS 8,8SilahlaştırılmışEPSS %89

    splunk · cloud16 Kas 2023

  • CVE-2023-6020
    60Bu hafta

    Ray Static File Local File Include

    YüksekCVSS 7,5SilahlaştırılmışEPSS %14

    ray project · ray16 Kas 2023

  • CVE-2023-26347
    33İzleyin

    CVE-2023-38205 issues | ColdFusion Admin Panel Access

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    adobe · coldfusion17 Kas 2023

  • CVE-2023-44350
    58Planlayın

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    KritikCVSS 9,8İstismar yokEPSS %64

    adobe · coldfusion17 Kas 2023

  • CVE-2023-44351
    54Planlayın

    Adobe ColdFusion RCE Security Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %50

    adobe · coldfusion17 Kas 2023

  • CVE-2023-44352
    49Planlayın

    Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version

    OrtaCVSS 6,1Kavram kanıtıEPSS %84

    adobe · coldfusion17 Kas 2023

  • CVE-2023-44353
    63Bu hafta

    ColdFusion WDDX Deserialization Gadgets

    KritikCVSS 9,8Kavram kanıtıEPSS %80

    adobe · coldfusion17 Kas 2023

  • CVE-2023-44355
    31İzleyin

    ColdFusion | Improper Input Validation (CWE-20)

    OrtaCVSS 4,3İstismar yokEPSS %47

    adobe · coldfusion17 Kas 2023

  • CVE-2023-43177
    64Bu hafta

    CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.

    KritikCVSS 9,8SilahlaştırılmışEPSS %81

    crushftp · crushftp17 Kas 2023

  • CVE-2023-6187
    50Planlayın

    Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload

    YüksekCVSS 8,8İstismar yokEPSS %51

    strangerstudios · paid memberships pro17 Kas 2023

  • CVE-2023-48223
    23İzleyin

    fast-jwt JWT Algorithm Confusion

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    nearform · fast-jwt20 Kas 2023

  • CVE-2023-48241
    52Planlayın

    XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service

    YüksekCVSS 7,5Kavram kanıtıEPSS %72

    xwiki · xwiki20 Kas 2023

  • CVE-2023-48292
    42Planlayın

    XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks

    YüksekCVSS 8,8Kavram kanıtıEPSS %22

    xwiki · admin tools20 Kas 2023

  • CVE-2023-38879
    31İzleyin

    The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulne

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    os4ed · opensis20 Kas 2023

  • CVE-2023-5652
    58Planlayın

    WP Hotel Booking < 2.0.8 - Unauthenticated SQLi

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    thimpress · wp hotel booking20 Kas 2023

  • CVE-2023-6199
    26İzleyin

    Book Stack v23.10.2 - LFR via Blind SSRF

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    bookstackapp · bookstack20 Kas 2023

  • CVE-2023-47643
    22İzleyin

    SuiteCRM has Unauthenticated Graphql Introspection Enabled

    OrtaCVSS 5,3Kavram kanıtıEPSS %3

    salesagility · suitecrm21 Kas 2023

  • CVE-2023-49103
    84Hemen

    An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %78

    owncloud · graph api21 Kas 2023

  • CVE-2023-49105
    82Hemen

    An issue was discovered in ownCloud owncloud/core before 10.13.1.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %43

    owncloud · owncloud server21 Kas 2023

  • CVE-2023-2437
    34İzleyin

    UserPro <= 5.1.1 - Authentication Bypass to Administrator

    YüksekCVSS 8,1Kavram kanıtıEPSS %6

    userproplugin · userpro22 Kas 2023

  • CVE-2023-5815
    40Planlayın

    News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    infornweb · news \& blog designer pack22 Kas 2023

  • CVE-2023-47014
    26İzleyin

    A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacke

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    remyandrade · sticky notes app22 Kas 2023

  • CVE-2023-47250
    35İzleyin

    In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attack

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    m-privacy · mprivacy-tools22 Kas 2023

  • CVE-2023-48646
    53Planlayın

    Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.

    YüksekCVSS 7,2İstismar yokEPSS %82

    zohocorp · manageengine recoverymanager plus22 Kas 2023

  • CVE-2023-47668
    30İzleyin

    WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    liquidweb · restrict content22 Kas 2023

  • CVE-2023-41807
    35İzleyin

    Linux Local Privilege Escalation Via GoTTY Page

    YüksekCVSS 8,8İstismar yokEPSS %0

    artica · pandora fms23 Kas 2023

  • CVE-2023-47529
    30İzleyin

    WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    themeisle · cloud templates \& patterns collection23 Kas 2023

  • CVE-2023-6275
    25İzleyin

    TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %2

    totvs · fluig24 Kas 2023

  • CVE-2023-4590
    39İzleyin

    Buffer Overflow vulnerability in Frhed

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    kimmov · frhed27 Kas 2023

  • CVE-2023-35985
    36İzleyin

    An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to prop

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    foxitsoftware · foxit reader27 Kas 2023

  • CVE-2023-49043
    43Planlayın

    Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapsk_crypto parameter i

    KritikCVSS 9,8İstismar yokEPSS %13

    tenda · ax1803 firmware27 Kas 2023

  • CVE-2023-41998
    44Planlayın

    Arcserve UDP Unauthenticated RCE

    KritikCVSS 9,8İstismar yokEPSS %15

    arcserve · udp27 Kas 2023

  • CVE-2023-4922
    44Planlayın

    WPB Show Core <= 2.2 - Unauthenticated Local File Inclusion

    KritikCVSS 9,8İstismar yokEPSS %15

    wpb show core project · wpb show core27 Kas 2023

  • CVE-2023-5559
    37İzleyin

    10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    10web · 10web booster27 Kas 2023

  • CVE-2023-5974
    40Planlayın

    WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    wpb show core project · wpb show core27 Kas 2023

  • CVE-2023-6329
    60Bu hafta

    Control iD iDSecure passwordCustom Authentication Bypass

    KritikCVSS 9,8SilahlaştırılmışEPSS %64

    controlid · idsecure27 Kas 2023

  • CVE-2023-48034
    24İzleyin

    An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless keystrokes and inject a

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    acer · sk-9662 firmware27 Kas 2023

  • CVE-2023-47437
    21İzleyin

    A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting (XSS) attack.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    pachno · pachno27 Kas 2023

  • CVE-2023-3368
    60Bu hafta

    Chamilo LMS Unauthenticated Command Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %69

    chamilo · chamilo28 Kas 2023

  • CVE-2023-48022
    64Bu hafta

    Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.

    KritikCVSS 9,8SilahlaştırılmışEPSS %83

    anyscale · ray28 Kas 2023

  • CVE-2023-48023
    47Planlayın

    Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF.

    KritikCVSS 9,1Kavram kanıtıEPSS %35

    anyscale · ray28 Kas 2023

  • CVE-2023-4220
    60Bu hafta

    Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

    OrtaCVSS 6,1SilahlaştırılmışEPSS %76

    chamilo · chamilo lms28 Kas 2023

  • CVE-2023-4226
    36İzleyin

    Chamilo LMS File Upload Functionality Remote Code Execution

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    chamilo · chamilo lms28 Kas 2023

  • CVE-2023-49313
    39İzleyin

    A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    horsicq · xmachoviewer28 Kas 2023

  • CVE-2023-49314
    32İzleyin

    Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses.

    YüksekCVSS 7,8Kavram kanıtıEPSS %4

    asana · desktop28 Kas 2023

  • CVE-2022-41678
    61Bu hafta

    Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

    YüksekCVSS 8,8Kavram kanıtıEPSS %85

    apache · activemq28 Kas 2023

  • CVE-2023-41264
    39İzleyin

    Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, l

    KritikCVSS 9,8İstismar yokEPSS %1

    netwrix · usercube28 Kas 2023

  • CVE-2023-45539
    32İzleyin

    HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unsp

    YüksekCVSS 8,2Kavram kanıtıEPSS %1

    haproxy · haproxy28 Kas 2023

  • CVE-2023-46944
    40Planlayın

    An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes wor

    YüksekCVSS 7,8SilahlaştırılmışEPSS %1

    gitkraken · gitlens28 Kas 2023

  • CVE-2023-6345
    73Bu hafta

    Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to pote

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %16

    google · chrome29 Kas 2023

  • CVE-2023-6350
    35İzleyin

    Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a cr

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    google · chrome29 Kas 2023

  • CVE-2023-40626
    30İzleyin

    [20231101] - Core - Exposure of environment variables

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    joomla · joomla\!29 Kas 2023

  • CVE-2023-35138
    51Planlayın

    A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NA

    KritikCVSS 9,8İstismar yokEPSS %39

    zyxel · nas326 firmware29 Kas 2023

  • CVE-2023-37928
    53Planlayın

    A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 fi

    YüksekCVSS 8,8İstismar yokEPSS %60

    zyxel · nas326 firmware29 Kas 2023

  • CVE-2023-4473
    51Planlayın

    A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(

    KritikCVSS 9,8İstismar yokEPSS %41

    zyxel · nas326 firmware29 Kas 2023

  • CVE-2023-4474
    48Planlayın

    The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware

    KritikCVSS 9,8İstismar yokEPSS %29

    zyxel · nas326 firmware29 Kas 2023

  • CVE-2023-47464
    42Planlayın

    Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the u

    YüksekCVSS 8,8Kavram kanıtıEPSS %22

    gl-inet · gl-ax1800 firmware30 Kas 2023

  • CVE-2023-49052
    36İzleyin

    File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload f

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    microweber · microweber30 Kas 2023

  • CVE-2023-47505
    29İzleyin

    WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)

    OrtaCVSS 5,4İstismar yokEPSS %25

    elementor · website builder30 Kas 2023

  • CVE-2023-5965
    28İzleyin

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    espocrm · espocrm30 Kas 2023

  • CVE-2023-5966
    28İzleyin

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    espocrm · espocrm30 Kas 2023

  • CVE-2023-40211
    31İzleyin

    WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    pickplugins · post grid combo30 Kas 2023

  • CVE-2023-40600
    31İzleyin

    WordPress EWWW Image Optimizer Plugin <= 7.2.0 is vulnerable to Sensitive Data Exposure

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    ewww · image optimizer30 Kas 2023

  • CVE-2023-6401
    31İzleyin

    NotePad++ dbghelp.exe uncontrolled search path

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    notepad-plus-plus · notepad\+\+30 Kas 2023

  • CVE-2023-6360
    58Planlayın

    The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' pa

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    joedolson · my calendar30 Kas 2023

  • CVE-2023-47207
    44Planlayın

    Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data

    KritikCVSS 9,8İstismar yokEPSS %16

    deltaww · infrasuite device master30 Kas 2023

  • CVE-2023-42916
    61Bu hafta

    An out-of-bounds read was addressed with improved input validation.

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %17

    apple · safari30 Kas 2023

  • CVE-2023-42917
    68Bu hafta

    A memory corruption vulnerability was addressed with improved locking.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %9

    apple · safari30 Kas 2023