İçeriğe atla
Noroxi

Yayın tarihine göre

Haziran 2024: sömürülen ve yeni ciddi CVE kayıtları

180 kayıt · 13 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2024-37642
    39İzleyin

    TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /fo

    KritikCVSS 9,1İstismar yokEPSS %11

    trendnet · tew-814dap firmware14 Haz 2024

  • CVE-2024-37888
    24İzleyin

    The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    mlewand · open link14 Haz 2024

  • CVE-2024-3105
    40Planlayın

    Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution

    KritikCVSS 9,9Kavram kanıtıEPSS %2

    themeisle · woody code snippets – insert php, css, js, and header/footer scripts15 Haz 2024

  • CVE-2023-27636
    21İzleyin

    Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    progress · sitefinity16 Haz 2024

  • CVE-2024-38396
    40Planlayın

    An issue was discovered in iTerm2 3.5.x before 3.5.2.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    iterm2 · iterm216 Haz 2024

  • CVE-2024-6039
    21İzleyin

    Feng Office Workspaces sql injection

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    fengoffice · feng office16 Haz 2024

  • CVE-2024-6043
    28İzleyin

    SourceCodester Best House Rental Management System admin_class.php login sql injection

    OrtaCVSS 6,9Kavram kanıtıEPSS %1

    mayurik · best house rental management system16 Haz 2024

  • CVE-2024-6047
    72Bu hafta

    GeoVision EOL device - OS Command Injection

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %10

    geovision · gv-dsp lpr firmware17 Haz 2024

  • CVE-2024-36527
    27İzleyin

    puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal.

    OrtaCVSS 6,5Kavram kanıtıEPSS %2

    17 Haz 2024

  • CVE-2024-34833
    40Planlayın

    Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    oretnom23 · payroll management system17 Haz 2024

  • CVE-2024-37079
    76Bu hafta

    vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %22

    vmware · cloud foundation18 Haz 2024

  • CVE-2024-37080
    43Planlayın

    vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

    KritikCVSS 9,8İstismar yokEPSS %12

    vmware · vcenter server18 Haz 2024

  • CVE-2024-37081
    40Planlayın

    The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %4

    vmware · vcenter server18 Haz 2024

  • CVE-2024-22002
    31İzleyin

    CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the insta

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    18 Haz 2024

  • CVE-2024-37791
    24İzleyin

    DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id.

    OrtaCVSS 6,0Kavram kanıtıEPSS %0

    18 Haz 2024

  • CVE-2024-6132
    35İzleyin

    Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    raajtram · pexels: free stock photos19 Haz 2024

  • CVE-2024-37881
    21İzleyin

    SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirect

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    eg secure solutions inc. · siteguard wp plugin19 Haz 2024

  • CVE-2023-40004
    32İzleyin

    Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins

    YüksekCVSS 7,3İstismar yokEPSS %10

    servmask · all-in-one wp migration box extension19 Haz 2024

  • CVE-2023-41805
    26İzleyin

    Broken Access Control vulnerability in multiple Brainstorm Force plugins

    OrtaCVSS 6,5İstismar yokEPSS %0

    brainstormforce · starter templates19 Haz 2024

  • CVE-2024-23443
    20İzleyin

    A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted

    OrtaCVSS 4,9Kavram kanıtıEPSS %1

    elastic · kibana19 Haz 2024

  • CVE-2024-22263
    40Planlayın

    Arbitrary File Write Vulnerability in Spring Cloud Data Flow

    YüksekCVSS 8,8Kavram kanıtıEPSS %17

    spring by vmware tanzu · spring cloud skipper19 Haz 2024

  • CVE-2024-34444
    35İzleyin

    WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    themepunch · slider revolution19 Haz 2024

  • CVE-2024-32030
    47Planlayın

    Remote code execution via JNDI resolution in JMX metrics collection in Kafka UI

    YüksekCVSS 8,1Kavram kanıtıEPSS %51

    provectus · kafka-ui19 Haz 2024

  • CVE-2024-36117
    31İzleyin

    Path traversal while serving Reposilite javadoc expanded files

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    reposilite · reposilite19 Haz 2024

  • CVE-2024-38355
    29İzleyin

    Unhandled 'error' event in socket.io

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    socketio · socket.io19 Haz 2024

  • CVE-2024-36680
    33İzleyin

    In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection.

    YüksekCVSS 7,5İstismar yokEPSS %10

    19 Haz 2024

  • CVE-2024-5182
    44Planlayın

    Path Traversal in mudler/localai

    KritikCVSS 9,1İstismar yokEPSS %25

    mudler · localai19 Haz 2024

  • CVE-2024-3605
    40Planlayın

    WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    thimpress · wp hotel booking19 Haz 2024

  • CVE-2024-5522
    27İzleyin

    HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

    OrtaCVSS 6,5Kavram kanıtıEPSS %2

    bplugins · html5 video player20 Haz 2024

  • CVE-2024-34693
    21İzleyin

    Apache Superset: Server arbitrary file read

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    apache · superset20 Haz 2024

  • CVE-2024-6188
    28İzleyin

    Parsec Automation TrackSYS pagedefinition direct request

    OrtaCVSS 6,9Kavram kanıtıEPSS %2

    parsec automation · tracksys20 Haz 2024

  • CVE-2024-28397
    40Planlayın

    An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

    OrtaCVSS 5,3SilahlaştırılmışEPSS %4

    20 Haz 2024

  • CVE-2012-6664
    60Bu hafta

    Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read

    KritikCVSS 9,1SilahlaştırılmışEPSS %29

    21 Haz 2024

  • CVE-2014-5470
    60Bu hafta

    Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data

    KritikCVSS 9,8SilahlaştırılmışEPSS %10

    21 Haz 2024

  • CVE-2024-34452
    24İzleyin

    CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    cmsimple-xh · cmsimple xh21 Haz 2024

  • CVE-2024-21514
    38İzleyin

    This affects versions of the package opencart/opencart from 0.0.0.

    YüksekCVSS 8,1Kavram kanıtıEPSS %19

    opencart · opencart22 Haz 2024

  • CVE-2024-21518
    32İzleyin

    This affects versions of the package opencart/opencart from 4.0.0.0.

    YüksekCVSS 7,2İstismar yokEPSS %14

    opencart · opencart22 Haz 2024

  • CVE-2024-4940
    24İzleyin

    Open Redirect in gradio-app/gradio

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    gradio project · gradio22 Haz 2024

  • CVE-2024-6269
    26İzleyin

    Ruijie RG-UAC HTTP POST Request sxh_vpnlic.php get_ip.addr_details command injection

    OrtaCVSS 5,1İstismar yokEPSS %20

    ruijie · rg-uac firmware23 Haz 2024

  • CVE-2024-4841
    13İzleyin

    Path Traversal in parisneo/lollms-webui

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    lollms · lollms-webui23 Haz 2024

  • CVE-2024-3121
    13İzleyin

    Remote Code Execution in create_conda_env function in parisneo/lollms

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    lollms · lollms23 Haz 2024

  • CVE-2024-27136
    42Planlayın

    Apache JSPWiki: Cross-site scripting vulnerability on upload page

    OrtaCVSS 6,1İstismar yokEPSS %60

    apache · jspwiki24 Haz 2024

  • CVE-2024-29868
    38İzleyin

    Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

    KritikCVSS 9,1Kavram kanıtıEPSS %5

    apache · streampipes24 Haz 2024

  • CVE-2024-37732
    29İzleyin

    Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.

    OrtaCVSS 6,1İstismar yokEPSS %16

    anchorcms · anchor cms24 Haz 2024

  • CVE-2024-34312
    24İzleyin

    Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplid

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    moodle · virtual programming lab24 Haz 2024

  • CVE-2024-34313
    39İzleyin

    An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    24 Haz 2024

  • CVE-2024-37759
    40Planlayın

    DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Vi

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    datagear · datagear24 Haz 2024

  • CVE-2023-50029
    40Planlayın

    PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    24 Haz 2024

  • CVE-2024-36683
    29İzleyin

    SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers t

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    24 Haz 2024

  • CVE-2024-6297
    40Planlayın

    Several WordPress.org Plugins <= Various Versions - Injected Backdoor

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    warfareplugins · social sharing plugin – social warfare25 Haz 2024

  • CVE-2024-6028
    43Planlayın

    Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    ays-pro · quiz maker25 Haz 2024

  • CVE-2024-37085
    66Bu hafta

    VMware ESXi contains an authentication bypass vulnerability.

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %26

    vmware · cloud foundation25 Haz 2024

  • CVE-2024-5806
    63Bu hafta

    MOVEit Transfer Authentication Bypass Vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %81

    progress · moveit transfer25 Haz 2024

  • CVE-2024-4883
    58Planlayın

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %64

    progress · whatsup gold25 Haz 2024

  • CVE-2024-4884
    46Planlayın

    WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %24

    progress · whatsup gold25 Haz 2024

  • CVE-2024-4885
    99Hemen

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    progress · whatsup gold25 Haz 2024

  • CVE-2024-5008
    40Planlayın

    WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %17

    progress · whatsup gold25 Haz 2024

  • CVE-2024-5009
    38İzleyin

    WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability

    YüksekCVSS 8,4Kavram kanıtıEPSS %17

    progress · whatsup gold25 Haz 2024

  • CVE-2024-5010
    51Planlayın

    WhatsUp Gold TestController multiple information disclosure vulnerabilities

    YüksekCVSS 7,5İstismar yokEPSS %69

    progress · whatsup gold25 Haz 2024

  • CVE-2024-5011
    44Planlayın

    WhatsUp Gold TestController Chart denial of service vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %47

    progress · whatsup gold25 Haz 2024

  • CVE-2024-5276
    63Bu hafta

    SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

    KritikCVSS 9,1SilahlaştırılmışEPSS %90

    fortra · filecatalyst workflow25 Haz 2024

  • CVE-2024-37843
    55Planlayın

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    KritikCVSS 9,8Kavram kanıtıEPSS %53

    craftcms · craft cms25 Haz 2024

  • CVE-2024-5016
    35İzleyin

    WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %22

    progress · whatsup gold25 Haz 2024

  • CVE-2024-37742
    32İzleyin

    Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows.

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    25 Haz 2024

  • CVE-2024-38526
    29İzleyin

    pdoc embeds link to malicious CDN if math mode is enabled

    YüksekCVSS 7,2Kavram kanıtıEPSS %3

    mitmproxy · pdoc25 Haz 2024

  • CVE-2024-21520
    8İzleyin

    Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template f

    DüşükCVSS 2,1Kavram kanıtıEPSS %1

    26 Haz 2024

  • CVE-2024-33326
    24İzleyin

    A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to e

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    26 Haz 2024

  • CVE-2024-4901
    31İzleyin

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    OrtaCVSS 5,4İstismar yokEPSS %33

    gitlab · gitlab26 Haz 2024

  • CVE-2024-5535
    38İzleyin

    SSL_select_next_proto buffer overread

    KritikCVSS 9,1Kavram kanıtıEPSS %5

    openssl · openssl27 Haz 2024

  • CVE-2024-5334
    31İzleyin

    Local File Read in stitionai/devika

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    stitionai · devika27 Haz 2024

  • CVE-2024-5936
    33İzleyin

    Open Redirect in imartinez/privategpt

    OrtaCVSS 6,1Kavram kanıtıEPSS %30

    pribai · privategpt27 Haz 2024

  • CVE-2024-6250
    31İzleyin

    Absolute Path Traversal in parisneo/lollms-webui

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    lollms · lollms web ui27 Haz 2024

  • CVE-2024-6127
    60Bu hafta

    BC Security Empire Path Traversal RCE

    KritikCVSS 9,8SilahlaştırılmışEPSS %10

    bc security · empire27 Haz 2024

  • CVE-2024-5735
    25İzleyin

    Full Path Disclosure in AdmirorFrames Joomla! Extension

    OrtaCVSS 6,3Kavram kanıtıEPSS %1

    admiror-design-studio · admirorframes28 Haz 2024

  • CVE-2024-5736
    32İzleyin

    SSRF in AdmirorFrames Joomla! Extension

    YüksekCVSS 8,2Kavram kanıtıEPSS %1

    admiror-design-studio · admirorframes28 Haz 2024

  • CVE-2024-5737
    25İzleyin

    HTML Injection in AdmirorFrames Joomla! Extension

    OrtaCVSS 6,3Kavram kanıtıEPSS %1

    admiror-design-studio · admirorframes28 Haz 2024

  • CVE-2024-38514
    30İzleyin

    NextChat Server-Side Request Forgery (SSRF)

    YüksekCVSS 7,4Kavram kanıtıEPSS %2

    chatgptnextweb · chatgpt-next-web28 Haz 2024

  • CVE-2024-5827
    40Planlayın

    Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    vanna-ai · vanna-ai/vanna28 Haz 2024

  • CVE-2024-6265
    40Planlayın

    UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    ayecode · userswp29 Haz 2024

  • CVE-2024-39840
    35İzleyin

    Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    29 Haz 2024