İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2024: sömürülen ve yeni ciddi CVE kayıtları

186 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2024-6746
    22İzleyin

    NaiboWang EasySpider HTTP GET Request server.js path traversal

    OrtaCVSS 5,3Kavram kanıtıEPSS %3

    easyspider · easyspider15 Tem 2024

  • CVE-2024-39887
    40Planlayın

    Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    apache · superset16 Tem 2024

  • CVE-2024-6457
    36İzleyin

    HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection

    YüksekCVSS 7,5İstismar yokEPSS %19

    pluginus · husky - products filter professional for woocommerce16 Tem 2024

  • CVE-2024-39700
    39İzleyin

    Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    jupyter · jupyterlab16 Tem 2024

  • CVE-2024-39908
    17İzleyin

    Denial of service in REXML

    OrtaCVSS 4,3Kavram kanıtıEPSS %1

    ruby-lang · rexml16 Tem 2024

  • CVE-2024-6778
    30İzleyin

    Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injec

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    google · chrome16 Tem 2024

  • CVE-2024-21136
    35İzleyin

    Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security).

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    oracle · retail xstore office16 Tem 2024

  • CVE-2024-21182
    82Hemen

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %74

    oracle · weblogic server16 Tem 2024

  • CVE-2024-6220
    50Planlayın

    简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %35

    keydatas · keydatas17 Tem 2024

  • CVE-2024-40617
    26İzleyin

    Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS).

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    fujitsu · network edgiot gw1500 firmware17 Tem 2024

  • CVE-2024-23469
    40Planlayın

    SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %17

    solarwinds · access rights manager17 Tem 2024

  • CVE-2024-23472
    38İzleyin

    SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

    YüksekCVSS 8,0İstismar yokEPSS %18

    solarwinds · access rights manager17 Tem 2024

  • CVE-2024-28074
    38İzleyin

    SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %10

    solarwinds · access rights manager17 Tem 2024

  • CVE-2024-20419
    64Bu hafta

    A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote at

    KritikCVSS 10,0SilahlaştırılmışEPSS %80

    cisco · smart software manager on-prem17 Tem 2024

  • CVE-2024-40119
    35İzleyin

    Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    17 Tem 2024

  • CVE-2024-40492
    28İzleyin

    Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function.

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    heartbeat · heartbeat17 Tem 2024

  • CVE-2024-40725
    22İzleyin

    Apache HTTP Server: source code disclosure with handlers configured via AddType

    OrtaCVSS 5,3Kavram kanıtıEPSS %4

    apache · http server18 Tem 2024

  • CVE-2024-40898
    30İzleyin

    Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    apache · http server18 Tem 2024

  • CVE-2024-39907
    48Planlayın

    a sqlinjection in 1Panel

    KritikCVSS 9,8Kavram kanıtıEPSS %29

    fit2cloud · 1panel18 Tem 2024

  • CVE-2024-39090
    24İzleyin

    The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    phpgurukul · online shopping portal18 Tem 2024

  • CVE-2024-6205
    40Planlayın

    PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    payplus · payplus payment gateway19 Tem 2024

  • CVE-2024-41107
    37İzleyin

    Apache CloudStack: SAML Signature Exclusion

    YüksekCVSS 8,1Kavram kanıtıEPSS %17

    apache · cloudstack19 Tem 2024

  • CVE-2024-39123
    28İzleyin

    In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitiz

    OrtaCVSS 5,4Kavram kanıtıEPSS %23

    janeczku · calibre-web19 Tem 2024

  • CVE-2024-40348
    34İzleyin

    An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.

    YüksekCVSS 8,2Kavram kanıtıEPSS %8

    bazarr · bazarr20 Tem 2024

  • CVE-2024-6497
    27İzleyin

    SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter

    OrtaCVSS 6,1İstismar yokEPSS %10

    squirrly · seo plugin by squirrly seo20 Tem 2024

  • CVE-2024-6244
    36İzleyin

    pz-frontend-manager < 1.0.6 - CSRF change user profile picture

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    projectzealous · pz frontend manager22 Tem 2024

  • CVE-2024-37259
    24İzleyin

    WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    wpextended · wp extended22 Tem 2024

  • CVE-2024-37261
    24İzleyin

    WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    wplab · wp-lister lite for amazon22 Tem 2024

  • CVE-2024-37211
    24İzleyin

    WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 6,1İstismar yokEPSS %0

    ali2woo · aliexpress dropshipping with alinext22 Tem 2024

  • CVE-2024-38773
    40Planlayın

    WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    formlift · formlift for infusionsoft web forms22 Tem 2024

  • CVE-2024-26020
    40Planlayın

    An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04.

    YüksekCVSS 8,8İstismar yokEPSS %15

    ankiweb · anki22 Tem 2024

  • CVE-2024-29073
    30İzleyin

    An vulnerability in the handling of Latex exists in Ankitects Anki 24.04.

    OrtaCVSS 6,5İstismar yokEPSS %11

    ankiweb · anki22 Tem 2024

  • CVE-2024-32152
    21İzleyin

    A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04.

    OrtaCVSS 4,3İstismar yokEPSS %12

    ankitects · anki22 Tem 2024

  • CVE-2024-32484
    38İzleyin

    An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04.

    YüksekCVSS 8,2İstismar yokEPSS %21

    ankitects · anki22 Tem 2024

  • CVE-2024-41131
    30İzleyin

    Out-of-bounds Write in SixLabors ImageSharp

    YüksekCVSS 7,5İstismar yokEPSS %0

    sixlabors · imagesharp22 Tem 2024

  • CVE-2024-38944
    40Planlayın

    An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateFo

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    22 Tem 2024

  • CVE-2024-34329
    33İzleyin

    Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    22 Tem 2024

  • CVE-2024-39250
    40Planlayın

    EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interf

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    efrotech · timetrax22 Tem 2024

  • CVE-2024-6911
    35İzleyin

    Unauthenticated Local File Inclusion

    YüksekCVSS 8,7Kavram kanıtıEPSS %4

    perkinelmer · processplus22 Tem 2024

  • CVE-2024-6828
    28İzleyin

    Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting

    YüksekCVSS 7,2İstismar yokEPSS %1

    davidanderson · redux framework22 Tem 2024

  • CVE-2024-6420
    35İzleyin

    Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    wpplugins · hide my wp ghost23 Tem 2024

  • CVE-2024-7014
    28İzleyin

    Improper multimedia file attachment validation in Telegram for Android app

    YüksekCVSS 7,1Kavram kanıtıEPSS %1

    telegram · telegram23 Tem 2024

  • CVE-2024-0760
    31İzleyin

    A flood of DNS messages over TCP may make the server unstable

    YüksekCVSS 7,5Kavram kanıtıEPSS %4

    isc · bind 923 Tem 2024

  • CVE-2024-41319
    41Planlayın

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd functi

    KritikCVSS 9,8Kavram kanıtıEPSS %5

    totolink · a6000r firmware23 Tem 2024

  • CVE-2024-6783
    19İzleyin

    Vue client-side XSS via prototype pollution

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    vue · vue23 Tem 2024

  • CVE-2024-6753
    24İzleyin

    Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    wpwebinfotech · social auto poster23 Tem 2024

  • CVE-2023-45249
    85Hemen

    Remote command execution due to use of default passwords.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %53

    acronis · cyber infrastructure24 Tem 2024

  • CVE-2024-40422
    39İzleyin

    The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack.

    KritikCVSS 9,1Kavram kanıtıEPSS %11

    stitionai · devika24 Tem 2024

  • CVE-2024-36539
    39İzleyin

    Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    projectcontour · contour24 Tem 2024

  • CVE-2024-41110
    44Planlayın

    Moby authz zero length regression

    KritikCVSS 9,9Kavram kanıtıEPSS %16

    moby · moby24 Tem 2024

  • CVE-2024-41662
    38İzleyin

    VNote vulnerable to Markdown XSS, which leads to RCE

    KritikCVSS 9,6Kavram kanıtıEPSS %1

    vnote project · vnote24 Tem 2024

  • CVE-2024-41667
    36İzleyin

    OpenAM FreeMarker template injection

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    openidentityplatform · openam24 Tem 2024

  • CVE-2024-37084
    46Planlayın

    CVE-2024-37084: Remote code execution in Spring Cloud Data Flow

    YüksekCVSS 8,8Kavram kanıtıEPSS %35

    vmware · spring cloud data flow25 Tem 2024

  • CVE-2024-40318
    28İzleyin

    An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    webkul · qloapps25 Tem 2024

  • CVE-2024-38288
    29İzleyin

    A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated atta

    YüksekCVSS 7,2Kavram kanıtıEPSS %3

    rhubcom · turbomeeting25 Tem 2024

  • CVE-2024-38289
    51Planlayın

    A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated

    KritikCVSS 9,8Kavram kanıtıEPSS %40

    rhubcom · turbomeeting25 Tem 2024

  • CVE-2024-40324
    21İzleyin

    A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fiel

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    datex-soft · e-staff25 Tem 2024

  • CVE-2024-7120
    49Planlayın

    Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection

    OrtaCVSS 5,3Kavram kanıtıEPSS %93

    raisecom · msg2300 firmware26 Tem 2024

  • CVE-2024-6922
    36İzleyin

    Server-Side Request Forgery in Automation 360

    OrtaCVSS 6,9Kavram kanıtıEPSS %30

    automationanywhere · automation 36026 Tem 2024

  • CVE-2024-41357
    28İzleyin

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.

    YüksekCVSS 7,1Kavram kanıtıEPSS %1

    phpipam · phpipam26 Tem 2024

  • CVE-2024-39304
    36İzleyin

    ChurchCRM SQL Injection Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    churchcrm · churchcrm26 Tem 2024

  • CVE-2024-42007
    23İzleyin

    SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files.

    OrtaCVSS 5,8Kavram kanıtıEPSS %0

    26 Tem 2024

  • CVE-2024-41628
    32İzleyin

    Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9

    YüksekCVSS 7,5Kavram kanıtıEPSS %6

    26 Tem 2024

  • CVE-2024-6569
    21İzleyin

    Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    vibhorchhabra · campaign monitor for wordpress27 Tem 2024

  • CVE-2024-42049
    37İzleyin

    TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    27 Tem 2024

  • CVE-2024-7156
    31İzleyin

    TOTOLINK A3700R apmib Configuration ExportSettings.sh information disclosure

    OrtaCVSS 6,9İstismar yokEPSS %13

    totolink · a3700r firmware28 Tem 2024

  • CVE-2024-6366
    45Planlayın

    User Profile Builder < 3.11.8 - Unauthenticated Media Upload

    KritikCVSS 9,1Kavram kanıtıEPSS %28

    cozmoslabs · profile builder29 Tem 2024

  • CVE-2024-7188
    29İzleyin

    Bylancer Quicklancer GET Parameter listing sql injection

    OrtaCVSS 6,9Kavram kanıtıEPSS %7

    bylancer · quicklancer29 Tem 2024

  • CVE-2024-41640
    24İzleyin

    Cross Site Scripting (XSS) vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    29 Tem 2024

  • CVE-2024-41810
    24İzleyin

    HTML injection in HTTP redirect body

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    twisted · twisted29 Tem 2024

  • CVE-2024-41817
    31İzleyin

    Arbitrary Code Execution in `AppImage` version `ImageMagick`

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    imagemagick · imagemagick29 Tem 2024

  • CVE-2024-6748
    40Planlayın

    Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injecti

    YüksekCVSS 8,3İstismar yokEPSS %23

    manageengine · opmanager29 Tem 2024

  • CVE-2024-40815
    30İzleyin

    A race condition was addressed with additional validation.

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    apple · ipados29 Tem 2024

  • CVE-2024-5765
    47Planlayın

    WpStickyBar <= 2.1.0 - Unauthenticated SQLi

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    a17lab · wpstickybar30 Tem 2024

  • CVE-2024-5975
    37İzleyin

    CZ Loan Management <= 1.1 - Unauthenticated SQLi

    KritikCVSS 9,1Kavram kanıtıEPSS %1

    contrive · cz loan management30 Tem 2024

  • CVE-2024-6536
    21İzleyin

    Zephyr Project Manager < 3.3.99 - Editor+ XSS

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    dylanjkotze · zephyr project manager30 Tem 2024

  • CVE-2024-40094
    21İzleyin

    GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of ser

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    30 Tem 2024

  • CVE-2024-7297
    41Planlayın

    Langflow Privilege Escalation

    YüksekCVSS 8,8İstismar yokEPSS %21

    langflow · langflow30 Tem 2024

  • CVE-2024-6255
    40Planlayın

    Path Traversal in gaizhenbiao/chuanhuchatgpt

    KritikCVSS 9,1İstismar yokEPSS %13

    gaizhenbiao · chuanhuchatgpt30 Tem 2024

  • CVE-2024-7135
    27İzleyin

    Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

    OrtaCVSS 6,5Kavram kanıtıEPSS %2

    tainacan · tainacan31 Tem 2024

  • CVE-2024-7264
    32İzleyin

    ASN.1 date parser overread

    OrtaCVSS 6,5İstismar yokEPSS %20

    haxx · libcurl31 Tem 2024

  • CVE-2024-7340
    37İzleyin

    W&B Weave server remote arbitrary file leak and privilege escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %5

    31 Tem 2024

  • CVE-2024-37900
    23İzleyin

    XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

    OrtaCVSS 4,6İstismar yokEPSS %15

    xwiki · xwiki31 Tem 2024

  • CVE-2024-41947
    22İzleyin

    XWiki Platform XSS through conflict resolution

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    xwiki · xwiki31 Tem 2024

  • CVE-2024-41955
    21İzleyin

    Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    opensecurity · mobile security framework31 Tem 2024

  • CVE-2024-7332
    43Planlayın

    TOTOLINK CP450 Telnet Service product.ini hard-coded password

    KritikCVSS 9,3Kavram kanıtıEPSS %20

    totolink · cp450 firmware31 Tem 2024