İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2024: sömürülen ve yeni ciddi CVE kayıtları

264 kayıt · 13 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 3 / 3

  • CVE-2023-52755
    47Planlayın

    ksmbd: fix slab out of bounds write in smb_inherit_dacl()

    KritikCVSS 9,8İstismar yokEPSS %28

    linux · linux kernel21 May 2024

  • CVE-2024-27130
    46Planlayın

    A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.

    YüksekCVSS 8,8Kavram kanıtıEPSS %37

    qnap · qts21 May 2024

  • CVE-2024-36039
    25İzleyin

    PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    21 May 2024

  • CVE-2024-22274
    29İzleyin

    The vCenter Server contains an authenticated remote code execution vulnerability.

    YüksekCVSS 7,2Kavram kanıtıEPSS %2

    vmware · cloud foundation21 May 2024

  • CVE-2024-22275
    19İzleyin

    The vCenter Server contains a partial file read vulnerability.

    OrtaCVSS 4,9Kavram kanıtıEPSS %0

    vmware · cloud foundation21 May 2024

  • CVE-2024-31989
    36İzleyin

    ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

    KritikCVSS 9,0Kavram kanıtıEPSS %1

    argoproj · argo cd21 May 2024

  • CVE-2024-21683
    61Bu hafta

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %88

    atlassian · confluence data center21 May 2024

  • CVE-2024-4443
    33İzleyin

    Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    businessdirectoryplugin · business directory22 May 2024

  • CVE-2021-47465
    22İzleyin

    KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()

    OrtaCVSS 5,5İstismar yokEPSS %0

    linux · linux kernel22 May 2024

  • CVE-2024-4157
    35İzleyin

    Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    fluentforms · contact form22 May 2024

  • CVE-2024-3495
    43Planlayın

    Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %13

    trustyplugins · country state city dropdown cf722 May 2024

  • CVE-2024-5195
    27İzleyin

    Arris VAP2500 diag_s.php command injection

    OrtaCVSS 5,1İstismar yokEPSS %23

    arris · vap2500 firmware22 May 2024

  • CVE-2024-5196
    27İzleyin

    Arris VAP2500 tools_command.php command injection

    OrtaCVSS 5,1İstismar yokEPSS %23

    arris · vap2500 firmware22 May 2024

  • CVE-2024-33222
    33İzleyin

    An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execu

    YüksekCVSS 8,4İstismar yokEPSS %0

    22 May 2024

  • CVE-2024-35627
    24İzleyin

    tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    22 May 2024

  • CVE-2024-22026
    26İzleyin

    A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execut

    OrtaCVSS 6,7Kavram kanıtıEPSS %1

    ivanti · endpoint manager mobile22 May 2024

  • CVE-2024-29849
    51Planlayın

    Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

    KritikCVSS 9,8Kavram kanıtıEPSS %38

    veeam · veeam backup \& replication22 May 2024

  • CVE-2024-4978
    72Bu hafta

    Malicious Code in Justice AV Solutions (JAVS) Viewer

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %26

    javs · javs viewer22 May 2024

  • CVE-2024-5230
    33İzleyin

    EnvaySoft FleetCart information disclosure

    OrtaCVSS 6,9Kavram kanıtıEPSS %18

    envaysoft · fleetcart22 May 2024

  • CVE-2024-4399
    37İzleyin

    CAS <= 1.0.0 - Unauthenticated SSRF

    KritikCVSS 9,1Kavram kanıtıEPSS %1

    apereo · central authentication service23 May 2024

  • CVE-2024-5084
    54Planlayın

    Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

    KritikCVSS 9,8SilahlaştırılmışEPSS %50

    hashthemes · hash form23 May 2024

  • CVE-2024-5243
    30İzleyin

    TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    tp-link · omada er605 firmware23 May 2024

  • CVE-2024-5246
    44Planlayın

    NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %31

    netgear · prosafe network management software 30023 May 2024

  • CVE-2024-5247
    43Planlayın

    NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %26

    netgear · prosafe network management system23 May 2024

  • CVE-2024-5315
    46Planlayın

    Multiple vulnerabilities in DOLIBARR's ERP CMS

    KritikCVSS 9,1Kavram kanıtıEPSS %34

    dolibarr · dolibarr erp\/crm24 May 2024

  • CVE-2024-4455
    24İzleyin

    YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    yithemes · yith woocommerce ajax search24 May 2024

  • CVE-2021-47553
    31İzleyin

    sched/scs: Reset task stack state in bringup_cpu()

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux kernel24 May 2024

  • CVE-2023-46442
    17İzleyin

    An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    24 May 2024

  • CVE-2024-36079
    26İzleyin

    An issue was discovered in Vaultize 21.07.27.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    24 May 2024

  • CVE-2024-30056
    21İzleyin

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    microsoft · edge chromium25 May 2024

  • CVE-2024-5356
    21İzleyin

    anji-plus AJ-Report testTransform;swagger-ui sql injection

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    anji-plus · aj-report26 May 2024

  • CVE-2024-35219
    34İzleyin

    OpenAPI Generator Online - Arbitrary File Read/Delete

    YüksekCVSS 8,3Kavram kanıtıEPSS %3

    openapitools · openapi-generator27 May 2024

  • CVE-2024-29415
    34İzleyin

    The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01,

    YüksekCVSS 8,1Kavram kanıtıEPSS %8

    27 May 2024

  • CVE-2024-5410
    37İzleyin

    Stored Cross-Site Scripting

    YüksekCVSS 8,3İstismar yokEPSS %13

    oringnet · iap-420 firmware28 May 2024

  • CVE-2024-5411
    41Planlayın

    Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.T

    YüksekCVSS 8,7İstismar yokEPSS %23

    oringnet · iap-420 firmware28 May 2024

  • CVE-2024-24684
    31İzleyin

    Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    libigl · libigl28 May 2024

  • CVE-2024-24685
    31İzleyin

    Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    libigl · libigl28 May 2024

  • CVE-2024-24686
    31İzleyin

    Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    libigl · libigl28 May 2024

  • CVE-2024-35397
    40Planlayın

    TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the

    YüksekCVSS 8,8İstismar yokEPSS %15

    totolink · cp900l firmware28 May 2024

  • CVE-2024-5274
    70Bu hafta

    Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %7

    google · chrome28 May 2024

  • CVE-2024-30212
    28İzleyin

    Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    microchip · mplab® harmony 3 core module28 May 2024

  • CVE-2024-34854
    43Planlayın

    F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`

    KritikCVSS 9,8İstismar yokEPSS %12

    f-logic · datacube3 firmware28 May 2024

  • CVE-2024-24919
    94Hemen

    Information disclosure

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %99

    checkpoint · quantum spark firmware28 May 2024

  • CVE-2023-46694
    32İzleyin

    Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands.

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    28 May 2024

  • CVE-2024-22641
    30İzleyin

    TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    tcpdf project · tcpdf28 May 2024

  • CVE-2024-35511
    18İzleyin

    phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php.

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    phpgurukul · men salon management system28 May 2024

  • CVE-2024-4358
    98Hemen

    Registration Authentication Bypass Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97

    telerik · report server 202429 May 2024

  • CVE-2024-35333
    33İzleyin

    A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3.

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    29 May 2024

  • CVE-2024-36114
    34İzleyin

    Decompressors can crash the JVM and leak memory content in Aircompressor

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    airlift · aircompressor29 May 2024

  • CVE-2024-5326
    35İzleyin

    Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    wpxpo · post grid gutenberg blocks for news, magazines, blog websites – postx30 May 2024

  • CVE-2024-36886
    31İzleyin

    tipc: fix UAF in error path

    YüksekCVSS 7,8Kavram kanıtıEPSS %1

    linux · linux kernel30 May 2024

  • CVE-2024-3300
    37İzleyin

    Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024

    KritikCVSS 9,0Kavram kanıtıEPSS %2

    dassault systèmes · delmia apriso30 May 2024

  • CVE-2024-35468
    21İzleyin

    A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    oretnom23 · human resource management system30 May 2024

  • CVE-2024-35469
    39İzleyin

    A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    oretnom23 · human resource management system30 May 2024

  • CVE-2024-37032
    62Bu hafta

    Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles

    YüksekCVSS 8,8SilahlaştırılmışEPSS %89

    ollama · ollama31 May 2024

  • CVE-2024-23692
    99Hemen

    Rejetto HTTP File Server 2.3m Unauthenticated RCE

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    rejetto · http file server31 May 2024

  • CVE-2024-5565
    37İzleyin

    Prompt Injection in "ask" API with visualization leads to RCE

    YüksekCVSS 8,1İstismar yokEPSS %15

    31 May 2024

  • CVE-2024-29822
    54Planlayın

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    YüksekCVSS 8,8İstismar yokEPSS %64

    ivanti · endpoint manager31 May 2024

  • CVE-2024-29823
    65Bu hafta

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    YüksekCVSS 8,8İstismar yokEPSS %99

    ivanti · endpoint manager31 May 2024

  • CVE-2024-29824
    95Hemen

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99

    ivanti · endpoint manager31 May 2024

  • CVE-2024-29825
    65Bu hafta

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    YüksekCVSS 8,8İstismar yokEPSS %99

    ivanti · endpoint manager31 May 2024

  • CVE-2024-29826
    65Bu hafta

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    YüksekCVSS 8,8İstismar yokEPSS %99

    ivanti · endpoint manager31 May 2024

  • CVE-2024-29827
    57Planlayın

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    YüksekCVSS 8,8İstismar yokEPSS %71

    ivanti · endpoint manager31 May 2024

  • CVE-2024-29848
    47Planlayın

    An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to exec

    YüksekCVSS 7,2İstismar yokEPSS %64

    ivanti · avalanche31 May 2024