İçeriğe atla
Noroxi

Yayın tarihine göre

Ağustos 2024: sömürülen ve yeni ciddi CVE kayıtları

167 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2024-35538
    21İzleyin

    Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specify

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    typecho · typecho19 Ağu 2024

  • CVE-2024-35539
    26İzleyin

    Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function.

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    typecho · typecho19 Ağu 2024

  • CVE-2024-7928
    26İzleyin

    FastAdmin lang path traversal

    OrtaCVSS 5,3Kavram kanıtıEPSS %16

    fastadmin · fastadmin19 Ağu 2024

  • CVE-2024-5932
    62Bu hafta

    GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

    KritikCVSS 9,8SilahlaştırılmışEPSS %76

    givewp · givewp19 Ağu 2024

  • CVE-2024-43202
    40Planlayın

    Apache DolphinScheduler: Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    apache · dolphinscheduler20 Ağu 2024

  • CVE-2024-21689
    33İzleyin

    This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689  was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, a

    YüksekCVSS 8,0Kavram kanıtıEPSS %2

    atlassian · bamboo20 Ağu 2024

  • CVE-2024-6379
    24İzleyin

    Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    OrtaCVSS 6,1İstismar yokEPSS %0

    3ds · 3dexperience20 Ağu 2024

  • CVE-2024-35540
    37İzleyin

    A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted

    KritikCVSS 9,0Kavram kanıtıEPSS %2

    typecho · typecho20 Ağu 2024

  • CVE-2024-42919
    39İzleyin

    eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    escanav · escan management console20 Ağu 2024

  • CVE-2024-7854
    40Planlayın

    Woo Inquiry <= 0.1 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    sjhoo · woo inquiry21 Ağu 2024

  • CVE-2024-28000
    59Planlayın

    WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %68

    litespeedtech · litespeed cache21 Ağu 2024

  • CVE-2024-40453
    39İzleyin

    squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varNa

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    squirrelly · squirrelly21 Ağu 2024

  • CVE-2024-5723
    47Planlayın

    Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %40

    centreon · centreon web21 Ağu 2024

  • CVE-2024-5725
    49Planlayın

    Centreon initCurveList SQL Injection Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %47

    centreon · centreon web21 Ağu 2024

  • CVE-2024-5762
    53Planlayın

    Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %71

    zen-cart · zen cart21 Ağu 2024

  • CVE-2023-29929
    30İzleyin

    Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service v

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    21 Ağu 2024

  • CVE-2024-6386
    43Planlayın

    WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

    YüksekCVSS 8,8Kavram kanıtıEPSS %25

    wpml · wpml21 Ağu 2024

  • CVE-2024-7965
    71Bu hafta

    Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %18

    google · chrome21 Ağu 2024

  • CVE-2024-7966
    35İzleyin

    Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer proce

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome21 Ağu 2024

  • CVE-2024-7971
    74Bu hafta

    Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.

    KritikCVSS 9,6KEVSilahlaştırılmışEPSS %21

    google · chrome21 Ağu 2024

  • CVE-2024-28987
    94Hemen

    SolarWinds Web Help Desk Hardcoded Credential Vulnerability

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %93

    solarwinds · web help desk21 Ağu 2024

  • CVE-2024-39717
    59Planlayın

    The Versa Director GUI provides an option to customize the look and feel of the user interface.

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %4

    versa-networks · versa director22 Ağu 2024

  • CVE-2024-40766
    75Bu hafta

    An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %18

    sonicwall · sonicos23 Ağu 2024

  • CVE-2024-42756
    39İzleyin

    An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page

    YüksekCVSS 8,8İstismar yokEPSS %13

    netgear · dgn1000ww firmware23 Ağu 2024

  • CVE-2024-32501
    45Planlayın

    A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13,

    KritikCVSS 9,8İstismar yokEPSS %19

    centreon · centreon web23 Ağu 2024

  • CVE-2024-42852
    24İzleyin

    Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    23 Ağu 2024

  • CVE-2024-7954
    66Bu hafta

    SPIP porte_plume Plugin Arbitrary PHP Execution

    KritikCVSS 9,8SilahlaştırılmışEPSS %90

    spip · spip23 Ağu 2024

  • CVE-2024-42845
    33İzleyin

    An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to ex

    YüksekCVSS 8,0Kavram kanıtıEPSS %2

    23 Ağu 2024

  • CVE-2024-40111
    19İzleyin

    A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4.

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    automad · automad23 Ağu 2024

  • CVE-2024-8129
    28İzleyin

    D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injection

    OrtaCVSS 5,3İstismar yokEPSS %22

    dlink · dns-1550-04 firmware24 Ağu 2024

  • CVE-2024-8132
    28İzleyin

    D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection

    OrtaCVSS 5,3İstismar yokEPSS %23

    dlink · dns-1550-04 firmware24 Ağu 2024

  • CVE-2024-45244
    21İzleyin

    Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    hyperledger · fabric24 Ağu 2024

  • CVE-2024-7313
    24İzleyin

    Shield Security < 20.0.6 - Reflected XSS

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    getshieldsecurity · shield security26 Ağu 2024

  • CVE-2024-45241
    34İzleyin

    A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated at

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    26 Ağu 2024

  • CVE-2024-45256
    60Bu hafta

    An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite database

    KritikCVSS 9,8SilahlaştırılmışEPSS %5

    26 Ağu 2024

  • CVE-2023-26315
    41Planlayın

    Xiaomi router has a command injection vulnerability after authorization

    YüksekCVSS 8,8İstismar yokEPSS %19

    mi · ax9000 firmware26 Ağu 2024

  • CVE-2024-43283
    30İzleyin

    WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    contest-gallery · contest gallery26 Ağu 2024

  • CVE-2024-45265
    39İzleyin

    A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL c

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    skyss · arfa-cms26 Ağu 2024

  • CVE-2024-8181
    46Planlayın

    Flowise Authentication Bypass

    YüksekCVSS 8,1Kavram kanıtıEPSS %45

    flowiseai · flowise27 Ağu 2024

  • CVE-2024-8182
    34İzleyin

    Flowise Denial of Service

    YüksekCVSS 7,5İstismar yokEPSS %13

    flowiseai · flowise27 Ağu 2024

  • CVE-2024-45264
    35İzleyin

    A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    skyss · arfa-cms27 Ağu 2024

  • CVE-2024-43788
    24İzleyin

    DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    webpack.js · webpack27 Ağu 2024

  • CVE-2022-39996
    19İzleyin

    Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    teldat · rs123 firmware27 Ağu 2024

  • CVE-2024-42905
    44Planlayın

    Beijing Digital China Cloud Technology Co., Ltd.

    KritikCVSS 9,8İstismar yokEPSS %15

    28 Ağu 2024

  • CVE-2024-45058
    32İzleyin

    Privilege escalation in i-Educar

    YüksekCVSS 8,1Kavram kanıtıEPSS %1

    portabilis · i-educar28 Ağu 2024

  • CVE-2024-8193
    35İzleyin

    Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome28 Ağu 2024

  • CVE-2024-8198
    35İzleyin

    Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome28 Ağu 2024

  • CVE-2024-45436
    31İzleyin

    extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    ollama · ollama28 Ağu 2024

  • CVE-2024-45440
    24İzleyin

    core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_co

    OrtaCVSS 5,3Kavram kanıtıEPSS %9

    drupal · drupal29 Ağu 2024

  • CVE-2024-7856
    38İzleyin

    MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion

    YüksekCVSS 8,1Kavram kanıtıEPSS %19

    sonaar · mp3 audio player for music\, radio \& podcast29 Ağu 2024

  • CVE-2024-5057
    40Planlayın

    WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    awesomemotive · easy digital downloads29 Ağu 2024

  • CVE-2024-38793
    35İzleyin

    WordPress Best Restaurant Menu by Pricelisto plugin <= 1.4.1 - SQL Injection vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    pricelisto · great restaurant menu wp29 Ağu 2024

  • CVE-2024-43144
    40Planlayın

    WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    stylemixthemes · cost calculator builder29 Ağu 2024

  • CVE-2024-43917
    60Bu hafta

    WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability

    KritikCVSS 9,8SilahlaştırılmışEPSS %22

    templateinvaders · ti woocommerce wishlist29 Ağu 2024

  • CVE-2024-43918
    39İzleyin

    WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    woobewoo · product table29 Ağu 2024

  • CVE-2024-43965
    40Planlayın

    WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    smackcoders · sendgrid29 Ağu 2024

  • CVE-2024-35133
    33İzleyin

    IBM Security Verify Access HTTP open redirect

    YüksekCVSS 8,2Kavram kanıtıEPSS %1

    ibm · security verify access29 Ağu 2024

  • CVE-2024-41358
    24İzleyin

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    phpipam · phpipam29 Ağu 2024

  • CVE-2024-6670
    97Hemen

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    progress · whatsup gold29 Ağu 2024

  • CVE-2024-6671
    45Planlayın

    WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    progress · whatsup gold29 Ağu 2024

  • CVE-2024-45488
    54Planlayın

    One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies.

    KritikCVSS 9,8Kavram kanıtıEPSS %50

    29 Ağu 2024

  • CVE-2024-3673
    38İzleyin

    Web Directory Free < 1.7.3 - Unauthenticated LFI

    KritikCVSS 9,1Kavram kanıtıEPSS %5

    salephpscripts · web directory free30 Ağu 2024

  • CVE-2024-8252
    36İzleyin

    Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    codection · clean login30 Ağu 2024

  • CVE-2024-45047
    24İzleyin

    Potential mXSS vulnerability due to improper HTML escaping in svelte

    OrtaCVSS 6,1İstismar yokEPSS %0

    svelte · svelte30 Ağu 2024

  • CVE-2024-6586
    30İzleyin

    Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards.

    YüksekCVSS 7,3Kavram kanıtıEPSS %1

    lightdash · lightdash30 Ağu 2024

  • CVE-2022-4539
    21İzleyin

    Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    miniorange · web application firewall31 Ağu 2024

  • CVE-2024-44946
    22İzleyin

    kcm: Serialise kcm_sendmsg() for the same socket.

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    linux · linux kernel31 Ağu 2024