İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2023: sömürülen ve yeni ciddi CVE kayıtları

162 kayıt · 9 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2023-46220
    42Planlayın

    An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of

    KritikCVSS 9,8İstismar yokEPSS %11

    ivanti · avalanche19 Ara 2023

  • CVE-2023-46225
    42Planlayın

    An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of

    KritikCVSS 9,8İstismar yokEPSS %11

    ivanti · avalanche19 Ara 2023

  • CVE-2023-46257
    42Planlayın

    An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of

    KritikCVSS 9,8İstismar yokEPSS %11

    ivanti · avalanche19 Ara 2023

  • CVE-2023-46259
    42Planlayın

    An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of

    KritikCVSS 9,8İstismar yokEPSS %11

    ivanti · avalanche19 Ara 2023

  • CVE-2023-46261
    42Planlayın

    An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of

    KritikCVSS 9,8İstismar yokEPSS %11

    ivanti · avalanche19 Ara 2023

  • CVE-2023-46262
    55Planlayın

    An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche R

    YüksekCVSS 7,5İstismar yokEPSS %82

    ivanti · avalanche19 Ara 2023

  • CVE-2023-46263
    64Bu hafta

    An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t

    KritikCVSS 9,8İstismar yokEPSS %81

    ivanti · avalanche19 Ara 2023

  • CVE-2023-46264
    66Bu hafta

    An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t

    KritikCVSS 9,8İstismar yokEPSS %90

    ivanti · avalanche19 Ara 2023

  • CVE-2023-6931
    28İzleyin

    Out-of-bounds write in Linux kernel's Performance Events system component

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    linux · linux kernel19 Ara 2023

  • CVE-2023-38126
    49Planlayın

    Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %71

    softing · edgeaggregator19 Ara 2023

  • CVE-2023-6977
    31İzleyin

    Path Traversal: '\..\filename'

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    lfprojects · mlflow20 Ara 2023

  • CVE-2023-32590
    31İzleyin

    WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    subscribe to category project · subscribe to category20 Ara 2023

  • CVE-2023-29384
    39İzleyin

    WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    hmplugin · jobwp20 Ara 2023

  • CVE-2023-7039
    43Planlayın

    Byzoro S210 importexport.php injection

    KritikCVSS 9,8İstismar yokEPSS %14

    byzoro · smart s210 firmware21 Ara 2023

  • CVE-2023-6546
    28İzleyin

    Kernel: gsm multiplexing race condition leads to privilege escalation

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    linux · linux kernel21 Ara 2023

  • CVE-2023-49084
    54Planlayın

    Local File Inclusion (RCE) in Cacti

    YüksekCVSS 8,8SilahlaştırılmışEPSS %64

    cacti · cacti21 Ara 2023

  • CVE-2023-7024
    67Bu hafta

    Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %6

    google · chrome21 Ara 2023

  • CVE-2023-51707
    39İzleyin

    MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets.

    KritikCVSS 9,8İstismar yokEPSS %1

    arraynetworks · arrayos ag21 Ara 2023

  • CVE-2023-51713
    31İzleyin

    make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backsla

    YüksekCVSS 7,5Kavram kanıtıEPSS %4

    proftpd · proftpd21 Ara 2023

  • CVE-2023-49085
    57Planlayın

    Cacti SQL Injection vulnerability

    YüksekCVSS 8,8SilahlaştırılmışEPSS %74

    cacti · cacti22 Ara 2023

  • CVE-2023-49792
    39İzleyin

    Bruteforce protection can be bypassed with misconfigured proxy

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    nextcloud · nextcloud server22 Ara 2023

  • CVE-2023-50254
    32İzleyin

    Deepin Reader RCE vulnerability due to a design flaw

    YüksekCVSS 7,8Kavram kanıtıEPSS %2

    deepin · deepin reader22 Ara 2023

  • CVE-2023-51448
    55Planlayın

    SQL Injection vulnerability when managing SNMP Notification Receivers

    YüksekCVSS 8,8İstismar yokEPSS %67

    cacti · cacti22 Ara 2023

  • CVE-2023-51449
    39İzleyin

    Make the `/file` secure against file traversal attacks

    YüksekCVSS 7,5Kavram kanıtıEPSS %28

    gradio project · gradio22 Ara 2023

  • CVE-2023-6972
    39İzleyin

    Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    backupbliss · backup migration22 Ara 2023

  • CVE-2023-7002
    37İzleyin

    Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url

    YüksekCVSS 7,2İstismar yokEPSS %30

    backupbliss · backup migration22 Ara 2023

  • CVE-2023-5961
    35İzleyin

    ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    moxa · iologik e1210 firmware23 Ara 2023

  • CVE-2023-51764
    22İzleyin

    Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_k

    OrtaCVSS 5,3Kavram kanıtıEPSS %2

    postfix · postfix24 Ara 2023

  • CVE-2023-7101
    67Bu hafta

    Arbitrary Code Execution (ACE) Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %18

    jmcnamara · spreadsheet\24 Ara 2023

  • CVE-2023-7102
    60Bu hafta

    Remote Code Execution (RCE) Vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %44

    barracuda · email security gateway 300 firmware24 Ara 2023

  • CVE-2023-7095
    43Planlayın

    Totolink A7100RU HTTP POST Request main buffer overflow

    KritikCVSS 9,8İstismar yokEPSS %13

    totolink · a7100ru firmware24 Ara 2023

  • CVE-2022-34267
    52Planlayın

    An issue was discovered in RWS WorldServer before 11.7.3.

    KritikCVSS 9,8Kavram kanıtıEPSS %42

    rws · worldserver25 Ara 2023

  • CVE-2023-49954
    40Planlayın

    The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    3cx · 3cx25 Ara 2023

  • CVE-2023-5180
    31İzleyin

    Out-of-bounds Write vulnerability exists in ODA Drawings SDK before 2024.12

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    opendesign · drawings sdk26 Ara 2023

  • CVE-2023-50968
    49Planlayın

    Apache OFBiz: Arbitrary file properties reading and SSRF attack

    YüksekCVSS 7,5Kavram kanıtıEPSS %63

    apache · ofbiz26 Ara 2023

  • CVE-2023-51467
    68Bu hafta

    Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %96

    apache · ofbiz26 Ara 2023

  • CVE-2023-51092
    43Planlayın

    Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.

    KritikCVSS 9,8İstismar yokEPSS %12

    tenda · m3 firmware26 Ara 2023

  • CVE-2023-5203
    31İzleyin

    WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    swit · wp sessions time monitoring full automatic26 Ara 2023

  • CVE-2023-5674
    38İzleyin

    WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint

    YüksekCVSS 8,8İstismar yokEPSS %10

    wpvibes · wp mail log26 Ara 2023

  • CVE-2023-5991
    40Planlayın

    Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    motopress · hotel booking lite26 Ara 2023

  • CVE-2023-6114
    39İzleyin

    Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

    YüksekCVSS 7,5Kavram kanıtıEPSS %30

    awesomemotive · duplicator26 Ara 2023

  • CVE-2023-49438
    24İzleyin

    An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    flask-security-too project · flask-security-too26 Ara 2023

  • CVE-2023-7116
    42Planlayın

    WeiYe-Jing datax-web HTTP POST Request killJob os command injection

    KritikCVSS 9,8Kavram kanıtıEPSS %9

    datax-web project · datax-web27 Ara 2023

  • CVE-2023-43481
    39İzleyin

    An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arb

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    tcl · browser tv web - browsehere27 Ara 2023

  • CVE-2023-43955
    39İzleyin

    The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    fedirtsapana · tv bro27 Ara 2023

  • CVE-2023-47882
    28İzleyin

    The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary Ja

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    kamivision · yi iot27 Ara 2023

  • CVE-2023-47883
    40Planlayın

    The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an exp

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    vladymix · tv browser27 Ara 2023

  • CVE-2023-49002
    30İzleyin

    An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    xenomtechnologies · phone dialer-voice call dialer27 Ara 2023

  • CVE-2023-49003
    21İzleyin

    An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simple

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    simplemobiletools · simple dialer27 Ara 2023

  • CVE-2023-49230
    36İzleyin

    An issue was discovered in Peplink Balance Two before 8.4.0.

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    peplink · balance two firmware28 Ara 2023

  • CVE-2023-50445
    40Planlayın

    Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %9

    gl-inet · gl-mt1300 firmware28 Ara 2023

  • CVE-2023-50839
    40Planlayın

    WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    wiselyhub · js help desk28 Ara 2023

  • CVE-2023-7137
    40Planlayın

    code-projects Client Details System HTTP POST Request sql injection

    YüksekCVSS 8,8İstismar yokEPSS %17

    fabian · client details system28 Ara 2023

  • CVE-2023-52085
    30İzleyin

    Winter CMS Local File Inclusion through Server Side Template Injection

    OrtaCVSS 5,4Kavram kanıtıEPSS %30

    wintercms · winter28 Ara 2023

  • CVE-2023-47840
    35İzleyin

    WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    qodeinteractive · qode essential addons29 Ara 2023

  • CVE-2023-49830
    35İzleyin

    WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE)

    YüksekCVSS 8,8İstismar yokEPSS %0

    brainstormforce · astra29 Ara 2023

  • CVE-2023-44088
    35İzleyin

    SQL Injection in Visual Console

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    pandorafms · pandora fms29 Ara 2023

  • CVE-2023-50070
    35İzleyin

    Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via d

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    oretnom23 · customer support system29 Ara 2023

  • CVE-2023-50071
    39İzleyin

    Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department v

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    customer support system project · customer support system29 Ara 2023

  • CVE-2023-7172
    28İzleyin

    PHPGurukul Hospital Management System Admin Dashboard sql injection

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    phpgurukul · hospital management system30 Ara 2023

  • CVE-2023-7173
    21İzleyin

    PHPGurukul Hospital Management System registration.php cross site scripting

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    phpgurukul · hospital management system30 Ara 2023

  • CVE-2023-50578
    40Planlayın

    Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    mingsoft · mcms30 Ara 2023