İçeriğe atla
Noroxi

Yayın tarihine göre

Şubat 2024: sömürülen ve yeni ciddi CVE kayıtları

177 kayıt · 11 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2024-25415
    36İzleyin

    A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP

    YüksekCVSS 7,2İstismar yokEPSS %27

    phoenixcart · ce phoenix cart15 Şub 2024

  • CVE-2024-25466
    31İzleyin

    Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arb

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    react-native-documents · document picker16 Şub 2024

  • CVE-2024-0015
    31İzleyin

    In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    google · android16 Şub 2024

  • CVE-2024-0023
    31İzleyin

    In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    google · android16 Şub 2024

  • CVE-2024-20931
    48Planlayın

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    oracle · weblogic server16 Şub 2024

  • CVE-2024-20953
    66Bu hafta

    Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %3

    oracle · agile product lifecycle management16 Şub 2024

  • CVE-2024-1512
    62Bu hafta

    MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %77

    stylemixthemes · masterstudy lms17 Şub 2024

  • CVE-2024-26308
    22İzleyin

    Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    apache · commons compress19 Şub 2024

  • CVE-2024-1346
    22İzleyin

    Weak MySQL database root password in LaborOfficeFree

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    laborofficefree · laborofficefree19 Şub 2024

  • CVE-2023-50257
    32İzleyin

    Disconnect Vulnerability in RTPS Packets Used by SROS2

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    eprosima · fast dds19 Şub 2024

  • CVE-2024-1651
    49Planlayın

    Torrentpier 2.4.1 - RCE

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    torrentpier · torrentpier19 Şub 2024

  • CVE-2023-49109
    40Planlayın

    Remote Code Execution in Apache Dolphinscheduler

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    apache · dolphinscheduler20 Şub 2024

  • CVE-2023-51770
    30İzleyin

    Apache DolphinScheduler: Arbitrary File Read Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    apache · dolphinscheduler20 Şub 2024

  • CVE-2024-25608
    24İzleyin

    HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    liferay · digital experience platform20 Şub 2024

  • CVE-2024-26581
    32İzleyin

    netfilter: nft_set_rbtree: skip end interval element from gc

    YüksekCVSS 7,8Kavram kanıtıEPSS %2

    linux · linux kernel20 Şub 2024

  • CVE-2023-42791
    36İzleyin

    A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 an

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    fortinet · fortimanager20 Şub 2024

  • CVE-2024-22369
    31İzleyin

    Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    apache · camel20 Şub 2024

  • CVE-2024-24763
    24İzleyin

    JumpServer Open Redirect Vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    fit2cloud · jumpserver20 Şub 2024

  • CVE-2024-1675
    38İzleyin

    Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restricti

    YüksekCVSS 8,8İstismar yokEPSS %10

    google · chrome21 Şub 2024

  • CVE-2024-1676
    27İzleyin

    Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a craf

    OrtaCVSS 5,4İstismar yokEPSS %18

    google · chrome21 Şub 2024

  • CVE-2023-42860
    22İzleyin

    A permissions issue was addressed with additional restrictions.

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    apple · macos21 Şub 2024

  • CVE-2024-0593
    21İzleyin

    Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    presstigers · simple job board21 Şub 2024

  • CVE-2023-52440
    38İzleyin

    ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

    YüksekCVSS 7,8Kavram kanıtıEPSS %21

    linux · linux kernel21 Şub 2024

  • CVE-2023-52442
    31İzleyin

    ksmbd: validate session id and tree id in compound request

    OrtaCVSS 5,5İstismar yokEPSS %29

    linux · linux kernel21 Şub 2024

  • CVE-2024-1708
    92Hemen

    Improper limitation of a pathname to a restricted directory (“path traversal”)

    YüksekCVSS 8,4KEVSilahlaştırılmışEPSS %95

    connectwise · screenconnect21 Şub 2024

  • CVE-2024-1709
    100Hemen

    Authentication bypass using an alternate path or channel

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %99

    connectwise · screenconnect21 Şub 2024

  • CVE-2024-23346
    32İzleyin

    pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

    YüksekCVSS 7,8Kavram kanıtıEPSS %3

    materialsvirtuallab · pymatgen21 Şub 2024

  • CVE-2024-1212
    98Hemen

    LoadMaster Pre-Authenticated OS Command Injection

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95

    progress · loadmaster21 Şub 2024

  • CVE-2024-25897
    39İzleyin

    ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    churchcrm · churchcrm21 Şub 2024

  • CVE-2024-25381
    24İzleyin

    There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    emlog · emlog21 Şub 2024

  • CVE-2024-1451
    49Planlayın

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    YüksekCVSS 8,7İstismar yokEPSS %51

    gitlab · gitlab21 Şub 2024

  • CVE-2024-25423
    28İzleyin

    An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 file.

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    nemetschek · cinema 4d21 Şub 2024

  • CVE-2024-22393
    37İzleyin

    Apache Answer: Pixel Flood Attack by uploading the large pixel file

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    apache · answer22 Şub 2024

  • CVE-2024-25850
    45Planlayın

    Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter

    KritikCVSS 9,8İstismar yokEPSS %19

    netis-systems · wf2780 firmware22 Şub 2024

  • CVE-2023-52160
    26İzleyin

    The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass.

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    debian · debian linux22 Şub 2024

  • CVE-2024-1781
    43Planlayın

    Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    totolink · x6000r firmware22 Şub 2024

  • CVE-2024-22243
    33İzleyin

    CVE-2024-22243: Spring Framework URL Parsing with Host Validation

    YüksekCVSS 8,1Kavram kanıtıEPSS %3

    spring · spring framework23 Şub 2024

  • CVE-2024-26594
    43Planlayın

    ksmbd: validate mech token in session setup

    YüksekCVSS 7,1İstismar yokEPSS %51

    linux · linux kernel23 Şub 2024

  • CVE-2024-22371
    30İzleyin

    Apache Camel issue on ExchangeCreatedEvent

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · camel26 Şub 2024

  • CVE-2024-25081
    16İzleyin

    Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

    OrtaCVSS 4,2Kavram kanıtıEPSS %1

    fontforge · fontforge26 Şub 2024

  • CVE-2024-25082
    27İzleyin

    Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    fontforge · fontforge26 Şub 2024

  • CVE-2024-24401
    53Planlayın

    SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitorin

    KritikCVSS 9,8Kavram kanıtıEPSS %45

    nagios · nagios xi26 Şub 2024

  • CVE-2024-24402
    40Planlayın

    An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd compo

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    nagios · nagios xi26 Şub 2024

  • CVE-2024-27088
    22İzleyin

    es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    medikoo · es5-ext26 Şub 2024

  • CVE-2019-25162
    31İzleyin

    i2c: Fix a potential use after free

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel26 Şub 2024

  • CVE-2024-27356
    37İzleyin

    An issue was discovered on certain GL-iNet devices.

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    gl-inet · mt6000 firmware26 Şub 2024

  • CVE-2024-1698
    62Bu hafta

    NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %77

    wpdeveloper · notificationx27 Şub 2024

  • CVE-2023-51518
    39İzleyin

    Apache James server: Privilege escalation via JMX pre-authentication deserialisation

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    apache · james27 Şub 2024

  • CVE-2023-7165
    31İzleyin

    JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    jetbackup · jetbackup27 Şub 2024

  • CVE-2023-7016
    31İzleyin

    Privilege Escalation in SafeNet Authentication Client

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    thalesgroup · safenet authentication client27 Şub 2024

  • CVE-2024-0197
    31İzleyin

    Privilege Escalation in Thales SafeNet Sentinel HASP LDK

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    thalesgroup · sentinel hasp ldk27 Şub 2024

  • CVE-2024-25723
    56Planlayın

    ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{us

    YüksekCVSS 8,8Kavram kanıtıEPSS %70

    zenml · zenml27 Şub 2024

  • CVE-2024-1403
    40Planlayın

    Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    progress · openedge27 Şub 2024

  • CVE-2024-26144
    21İzleyin

    Possible Sensitive Session Information Leak in Active Storage

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    rubyonrails · rails27 Şub 2024

  • CVE-2024-25169
    39İzleyin

    An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    jupo · mezzanine28 Şub 2024

  • CVE-2024-25170
    36İzleyin

    An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    jupo · mezzanine28 Şub 2024

  • CVE-2024-25202
    24İzleyin

    Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    phpgurukul · user registration \& login and user management system28 Şub 2024

  • CVE-2024-22983
    32İzleyin

    SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    projectworlds · visitor management system28 Şub 2024

  • CVE-2024-25869
    41Planlayın

    An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitra

    YüksekCVSS 8,8İstismar yokEPSS %18

    codeastro · membership management system28 Şub 2024

  • CVE-2024-22532
    26İzleyin

    Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service via crafted xwd file.

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    xnview · nconvert28 Şub 2024

  • CVE-2024-25422
    39İzleyin

    SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMC

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    sem-cms · semcms28 Şub 2024

  • CVE-2024-25126
    41Planlayın

    Rack ReDos in content type parsing (2nd degree polynomial)

    YüksekCVSS 7,5İstismar yokEPSS %35

    rack · rack28 Şub 2024

  • CVE-2024-0379
    17İzleyin

    Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    smashballoon · custom twitter feeds28 Şub 2024

  • CVE-2024-0590
    24İzleyin

    Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    microsoft · clarity28 Şub 2024

  • CVE-2024-1939
    36İzleyin

    Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    google · chrome28 Şub 2024

  • CVE-2024-21725
    34İzleyin

    [20240204] - Core - XSS in mail address outputs

    OrtaCVSS 6,1İstismar yokEPSS %32

    joomla · joomla\!28 Şub 2024

  • CVE-2024-21726
    41Planlayın

    [20240205] - Core - Inadequate content filtering within the filter code

    OrtaCVSS 6,5İstismar yokEPSS %48

    joomla · joomla\!28 Şub 2024

  • CVE-2024-22939
    35İzleyin

    Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    sunkaifei · flycms28 Şub 2024

  • CVE-2024-25065
    50Planlayın

    Apache OFBiz: Path traversal allowing authentication bypass.

    KritikCVSS 9,1İstismar yokEPSS %47

    apache · ofbiz28 Şub 2024

  • CVE-2024-25830
    46Planlayın

    F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction.

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    f-logic · datacube3 firmware28 Şub 2024

  • CVE-2024-25832
    39İzleyin

    F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dan

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    f-logic · datacube328 Şub 2024

  • CVE-2023-51800
    21İzleyin

    Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a cra

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    school fees management system project · school fees management system1.028 Şub 2024

  • CVE-2023-51801
    39İzleyin

    SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted p

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    oretnom23 · simple student attendance system28 Şub 2024

  • CVE-2023-51802
    24İzleyin

    Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code vi

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    oretnom23 · simple student attendance system28 Şub 2024

  • CVE-2024-25291
    39İzleyin

    Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    deskfiler · deskfiler29 Şub 2024

  • CVE-2024-25292
    38İzleyin

    Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa

    KritikCVSS 9,6Kavram kanıtıEPSS %1

    martinbarker · rendertune29 Şub 2024

  • CVE-2024-25180
    39İzleyin

    An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    pdfmake project · pdfmake29 Şub 2024