İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2024: sömürülen ve yeni ciddi CVE kayıtları

185 kayıt · 15 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2023-6549
    77Bu hafta

    Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %57

    citrix · netscaler application delivery controller17 Oca 2024

  • CVE-2024-22416
    35İzleyin

    Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    pyload-ng project · pyload-ng17 Oca 2024

  • CVE-2023-6184
    42Planlayın

    Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting

    YüksekCVSS 7,2İstismar yokEPSS %46

    citrix · virtual apps and desktops17 Oca 2024

  • CVE-2023-6970
    24İzleyin

    WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    bootstrapped · wp recipe maker18 Oca 2024

  • CVE-2024-23659
    24İzleyin

    SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    spip · spip19 Oca 2024

  • CVE-2024-0705
    31İzleyin

    Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    webtoffee · stripe payment plugin for woocommerce19 Oca 2024

  • CVE-2024-21733
    25İzleyin

    Apache Tomcat: Leaking of unrelated request bodies in default error page

    OrtaCVSS 5,3Kavram kanıtıEPSS %14

    apache · tomcat19 Oca 2024

  • CVE-2024-0717
    26İzleyin

    D-Link Good Line Router v2 HTTP GET Request devinfo information disclosure

    OrtaCVSS 5,3İstismar yokEPSS %18

    dlink · dir-825acg1 firmware19 Oca 2024

  • CVE-2024-0723
    31İzleyin

    freeSSHd denial of service

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    freesshd · freesshd19 Oca 2024

  • CVE-2024-0725
    31İzleyin

    ProSSHD denial of service

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    prosshd · prosshd19 Oca 2024

  • CVE-2024-0737
    31İzleyin

    Xlightftpd Xlight FTP Server Login denial of service

    YüksekCVSS 7,5Kavram kanıtıEPSS %4

    xlightftpd · xlight ftp server19 Oca 2024

  • CVE-2023-46447
    17İzleyin

    The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    popsdiabetes · rebel20 Oca 2024

  • CVE-2024-0623
    17İzleyin

    VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    vektor-inc · vk block patterns20 Oca 2024

  • CVE-2024-0679
    26İzleyin

    ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    themegrill · colormag20 Oca 2024

  • CVE-2024-0769
    94Hemen

    D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %82

    dlink · dir-859 firmware21 Oca 2024

  • CVE-2024-22895
    35İzleyin

    DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.

    YüksekCVSS 8,8İstismar yokEPSS %0

    dedecms · dedecms22 Oca 2024

  • CVE-2024-0778
    49Planlayın

    Uniview ISC 2500-S VM.php setNatConfig os command injection

    KritikCVSS 9,8İstismar yokEPSS %32

    uniview · isc 2500-s firmware22 Oca 2024

  • CVE-2024-0204
    68Bu hafta

    Authentication Bypass in GoAnywhere MFT

    KritikCVSS 9,8SilahlaştırılmışEPSS %95

    fortra · goanywhere managed file transfer22 Oca 2024

  • CVE-2024-0783
    39İzleyin

    Project Worlds Online Admission System documents.php unrestricted upload

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    online admission system project · online admission system22 Oca 2024

  • CVE-2024-23339
    26İzleyin

    hoolock does not block Prototype pollution with object-path related utilities

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    elijahharry · hoolock22 Oca 2024

  • CVE-2024-23208
    31İzleyin

    The issue was addressed with improved memory handling.

    YüksekCVSS 7,8Kavram kanıtıEPSS %1

    apple · ipados22 Oca 2024

  • CVE-2024-23222
    68Bu hafta

    A type confusion issue was addressed with improved checks.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %10

    apple · safari22 Oca 2024

  • CVE-2024-0741
    27İzleyin

    An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.

    OrtaCVSS 6,5Kavram kanıtıEPSS %2

    mozilla · firefox23 Oca 2024

  • CVE-2023-36177
    47Planlayın

    An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information

    KritikCVSS 9,8İstismar yokEPSS %27

    badaix · snapcast23 Oca 2024

  • CVE-2023-47115
    21İzleyin

    Label Studio XSS Vulnerability on Avatar Upload

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    humansignal · label studio23 Oca 2024

  • CVE-2024-23638
    44Planlayın

    SQUID-2023:11 Denial of Service in Cache Manager

    OrtaCVSS 6,5İstismar yokEPSS %60

    squid-cache · squid23 Oca 2024

  • CVE-2023-43317
    35İzleyin

    An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storag

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    coign · coign24 Oca 2024

  • CVE-2023-6697
    24İzleyin

    WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    wpgmaps · wp go maps24 Oca 2024

  • CVE-2024-22651
    45Planlayın

    There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.

    KritikCVSS 9,8İstismar yokEPSS %20

    dlink · dir-815 firmware24 Oca 2024

  • CVE-2024-23897
    99Hemen

    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character follo

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    jenkins · jenkins24 Oca 2024

  • CVE-2024-23898
    55Planlayın

    Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests ma

    YüksekCVSS 8,8Kavram kanıtıEPSS %67

    jenkins · jenkins24 Oca 2024

  • CVE-2024-0624
    21İzleyin

    Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    strangerstudios · paid memberships pro24 Oca 2024

  • CVE-2024-23985
    60Bu hafta

    EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %3

    ezhometech · ezserver25 Oca 2024

  • CVE-2024-22729
    60Bu hafta

    NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.

    KritikCVSS 9,8SilahlaştırılmışEPSS %70

    netis-systems · mw5360 firmware25 Oca 2024

  • CVE-2023-52076
    31İzleyin

    Remote Code Execution Vulnerability in Atril's EPUB ebook parsing

    YüksekCVSS 7,8Kavram kanıtıEPSS %1

    mate-desktop · atril25 Oca 2024

  • CVE-2023-41474
    37İzleyin

    Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via t

    OrtaCVSS 6,5Kavram kanıtıEPSS %37

    ivanti · avalanche25 Oca 2024

  • CVE-2023-52356
    31İzleyin

    Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    libtiff · libtiff25 Oca 2024

  • CVE-2023-52251
    61Bu hafta

    An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/

    YüksekCVSS 8,8SilahlaştırılmışEPSS %86

    provectus · ui25 Oca 2024

  • CVE-2024-24399
    33İzleyin

    An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code

    YüksekCVSS 7,2İstismar yokEPSS %15

    lepton-cms · leptoncms25 Oca 2024

  • CVE-2024-22922
    39İzleyin

    An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the l

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    projectworlds · visitor management system25 Oca 2024

  • CVE-2024-23055
    24İzleyin

    An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    plone · plone docker official image25 Oca 2024

  • CVE-2024-23624
    47Planlayın

    D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %25

    dlink · dap-1650 firmware25 Oca 2024

  • CVE-2024-0402
    40Planlayın

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    KritikCVSS 9,9Kavram kanıtıEPSS %3

    gitlab · gitlab25 Oca 2024

  • CVE-2023-5612
    60Bu hafta

    Missing Authorization in GitLab

    OrtaCVSS 5,3SilahlaştırılmışEPSS %4

    gitlab · gitlab25 Oca 2024

  • CVE-2024-0918
    36İzleyin

    TRENDnet TEW-800MB POST Request os command injection

    YüksekCVSS 7,2İstismar yokEPSS %25

    trendnet · tew-800mb firmware26 Oca 2024

  • CVE-2024-0919
    35İzleyin

    TRENDnet TEW-815DAP POST Request do_setNTP command injection

    YüksekCVSS 7,2İstismar yokEPSS %22

    trendnet · tew-815dap firmware26 Oca 2024

  • CVE-2024-0921
    50Planlayın

    D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection

    KritikCVSS 9,8İstismar yokEPSS %37

    dlink · dir-816 a2 firmware26 Oca 2024

  • CVE-2024-0930
    44Planlayın

    Tenda AC10U fromSetWirelessRepeat stack-based overflow

    KritikCVSS 9,8İstismar yokEPSS %15

    tendacn · ac10u firmware26 Oca 2024

  • CVE-2024-0932
    39İzleyin

    Tenda AC10U setSmartPowerManagement stack-based overflow

    KritikCVSS 9,8İstismar yokEPSS %0

    tendacn · ac10u firmware26 Oca 2024

  • CVE-2024-0939
    52Planlayın

    Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    byzoro · smart s210 firmware26 Oca 2024

  • CVE-2024-23738
    39İzleyin

    An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeCli

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    postman · postman27 Oca 2024

  • CVE-2024-23743
    13İzleyin

    Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments.

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    notion · notion27 Oca 2024

  • CVE-2024-23739
    40Planlayın

    An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNode

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    discord · discord27 Oca 2024

  • CVE-2024-23741
    39İzleyin

    An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeCliln

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    vercel · hyper27 Oca 2024

  • CVE-2024-23742
    40Planlayın

    An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClil

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    loom · loom27 Oca 2024

  • CVE-2024-23740
    39İzleyin

    An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilns

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    getkap · kap28 Oca 2024

  • CVE-2024-0986
    56Planlayın

    Issabel PBX Asterisk-Cli os command injection

    KritikCVSS 9,8Kavram kanıtıEPSS %58

    issabel · pbx28 Oca 2024

  • CVE-2024-23747
    30İzleyin

    The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    modernasistemas · modernanet hospital management system 202429 Oca 2024

  • CVE-2023-6389
    32İzleyin

    WordPress Toolbar <= 2.2.6 - Open Redirect

    OrtaCVSS 6,1Kavram kanıtıEPSS %26

    abhinavsingh · wordpress toolbar29 Oca 2024

  • CVE-2024-24134
    19İzleyin

    Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update M

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    remyandrade · online food menu29 Oca 2024

  • CVE-2024-24135
    24İzleyin

    Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XS

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    remyandrade · product inventory with export to excel29 Oca 2024

  • CVE-2024-24136
    24İzleyin

    The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (X

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    remyandrade · math game29 Oca 2024

  • CVE-2024-24139
    28İzleyin

    Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    remyandrade · login system with email verification29 Oca 2024

  • CVE-2024-24140
    28İzleyin

    Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    remyandrade · daily habit tracker29 Oca 2024

  • CVE-2024-24141
    39İzleyin

    Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    remyandrade · school task manager29 Oca 2024

  • CVE-2024-1021
    49Planlayın

    Rebuild HTTP Request readRawText server-side request forgery

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    ruifang-tech · rebuild29 Oca 2024

  • CVE-2024-23334
    53Planlayın

    aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

    YüksekCVSS 7,5Kavram kanıtıEPSS %76

    aiohttp · aiohttp29 Oca 2024

  • CVE-2023-5372
    37İzleyin

    The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versi

    YüksekCVSS 7,2İstismar yokEPSS %28

    zyxel · nas326 firmware29 Oca 2024

  • CVE-2024-1061
    42Planlayın

    The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parame

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    bplugins · html5 video player30 Oca 2024

  • CVE-2024-22894
    27İzleyin

    An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    novelan · heat pumps firmware30 Oca 2024

  • CVE-2024-24328
    41Planlayın

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFi

    KritikCVSS 9,8Kavram kanıtıEPSS %6

    totolink · a3300r firmware30 Oca 2024

  • CVE-2024-24329
    41Planlayın

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortF

    KritikCVSS 9,8Kavram kanıtıEPSS %6

    totolink · a3300r firmware30 Oca 2024

  • CVE-2024-24565
    27İzleyin

    CrateDB database has an arbitrary file read vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %3

    cratedb · cratedb30 Oca 2024

  • CVE-2024-21388
    36İzleyin

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %31

    microsoft · edge chromium30 Oca 2024

  • CVE-2024-23745
    40Planlayın

    In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    notion · web clipper30 Oca 2024

  • CVE-2024-1086
    69Bu hafta

    Use-after-free in Linux kernel's netfilter: nf_tables component

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %28

    linux · linux kernel31 Oca 2024

  • CVE-2023-6246
    32İzleyin

    Glibc: heap-based buffer overflow in __vsyslog_internal()

    YüksekCVSS 7,8Kavram kanıtıEPSS %4

    gnu · glibc31 Oca 2024

  • CVE-2024-1112
    39İzleyin

    Buffer Overflow Vulnerability in Resource Hacker

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    angusj · resource hacker31 Oca 2024

  • CVE-2024-21888
    61Bu hafta

    A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a use

    YüksekCVSS 8,8İstismar yokEPSS %85

    ivanti · connect secure31 Oca 2024

  • CVE-2024-21893
    92Hemen

    A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)

    YüksekCVSS 8,2KEVSilahlaştırılmışEPSS %99

    ivanti · connect secure31 Oca 2024

  • CVE-2024-21626
    40Planlayın

    runc container breakout through process.cwd trickery and leaked fds

    YüksekCVSS 8,6SilahlaştırılmışEPSS %18

    linuxfoundation · runc31 Oca 2024

  • CVE-2024-23651
    29İzleyin

    BuildKit possible race condition with accessing subpaths from cache mounts

    YüksekCVSS 7,4İstismar yokEPSS %0

    mobyproject · buildkit31 Oca 2024

  • CVE-2024-23652
    37İzleyin

    BuildKit possible host system access from mount stub cleaner

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    mobyproject · buildkit31 Oca 2024

  • CVE-2024-23653
    40Planlayın

    BuildKit interactive containers API does not validate entitlements check

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    mobyproject · buildkit31 Oca 2024

  • CVE-2024-24747
    45Planlayın

    MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %34

    minio · minio31 Oca 2024