İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2024: sömürülen ve yeni ciddi CVE kayıtları

163 kayıt · 13 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2024-46982
    48Planlayın

    Cache Poisoning in next.js

    YüksekCVSS 7,5Kavram kanıtıEPSS %59

    vercel · next.js17 Eyl 2024

  • CVE-2024-43971
    24İzleyin

    WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    sunshinephotocart · sunshine photo cart17 Eyl 2024

  • CVE-2024-39081
    16İzleyin

    An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications.

    OrtaCVSS 4,2Kavram kanıtıEPSS %0

    jktyre · smart tyre car \& bike18 Eyl 2024

  • CVE-2024-44542
    39İzleyin

    SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    todesk · todesk18 Eyl 2024

  • CVE-2023-47105
    35İzleyin

    exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without aut

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    18 Eyl 2024

  • CVE-2024-46986
    51Planlayın

    Arbitrary file write leading to RCE in Camaleon CMS

    KritikCVSS 9,9Kavram kanıtıEPSS %40

    tuzitio · camaleon cms18 Eyl 2024

  • CVE-2024-46987
    40Planlayın

    Arbitrary path traversal in Camaleon CMS

    YüksekCVSS 7,7SilahlaştırılmışEPSS %14

    tuzitio · camaleon cms18 Eyl 2024

  • CVE-2024-46377
    39İzleyin

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/a

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    mayurik · best house rental management system18 Eyl 2024

  • CVE-2024-8698
    31İzleyin

    Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak

    YüksekCVSS 7,7Kavram kanıtıEPSS %2

    red hat · red hat build of keycloak19 Eyl 2024

  • CVE-2024-8883
    25İzleyin

    Keycloak: vulnerable redirect uri validation results in open redirec

    OrtaCVSS 6,1Kavram kanıtıEPSS %2

    redhat · build of keycloak19 Eyl 2024

  • CVE-2024-8963
    96Hemen

    Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %98

    ivanti · endpoint manager cloud services appliance19 Eyl 2024

  • CVE-2024-9004
    26İzleyin

    D-Link DAR-7000 Backup_Server_commit.php os command injection

    OrtaCVSS 5,3İstismar yokEPSS %16

    dlink · dar-7000 firmware19 Eyl 2024

  • CVE-2023-27584
    49Planlayın

    Dragonfly2 vulnerable to hard coded cyptographic key

    KritikCVSS 9,8Kavram kanıtıEPSS %33

    linuxfoundation · dragonfly19 Eyl 2024

  • CVE-2024-45410
    30İzleyin

    HTTP client can remove the X-Forwarded headers in Traefik

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    traefik · traefik19 Eyl 2024

  • CVE-2024-45614
    21İzleyin

    Header normalization allows for client to clobber proxy set headers in Puma

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    puma · puma19 Eyl 2024

  • CVE-2024-9007
    21İzleyin

    jeanmarc77 123solar detailed.php cross site scripting

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    jeanmarc77 · 123solar19 Eyl 2024

  • CVE-2024-42346
    21İzleyin

    Stored Cross Site Scripting (Stored XSS) in Galaxy

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    galaxyproject · galaxy20 Eyl 2024

  • CVE-2024-47062
    38İzleyin

    Multiple SQL Injections and ORM Leak in navidrome

    KritikCVSS 9,4Kavram kanıtıEPSS %4

    navidrome · navidrome20 Eyl 2024

  • CVE-2024-42323
    37İzleyin

    Apache HertzBeat: RCE by snakeYaml deser load malicious xml

    YüksekCVSS 8,8Kavram kanıtıEPSS %8

    apache · hertzbeat21 Eyl 2024

  • CVE-2024-9076
    26İzleyin

    DedeCMS article_string_mix.php os command injection

    OrtaCVSS 5,1İstismar yokEPSS %20

    dedecms · dedecms21 Eyl 2024

  • CVE-2024-43989
    34İzleyin

    WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %12

    firsh · justified image grid22 Eyl 2024

  • CVE-2024-23922
    28İzleyin

    Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability

    OrtaCVSS 6,8Kavram kanıtıEPSS %1

    sony · xav-ax5500 firmware23 Eyl 2024

  • CVE-2024-47066
    39İzleyin

    Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    lobehub · lobe chat23 Eyl 2024

  • CVE-2024-9014
    29İzleyin

    OAuth2 client id and secret exposed through the web browser in pgAdmin 4

    OrtaCVSS 6,5Kavram kanıtıEPSS %9

    pgadmin · pgadmin 423 Eyl 2024

  • CVE-2023-46948
    21İzleyin

    A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbit

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    23 Eyl 2024

  • CVE-2024-42861
    30İzleyin

    An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    linuxptp project · linuxptp23 Eyl 2024

  • CVE-2023-5359
    30İzleyin

    W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    boldgrid · w3 total cache24 Eyl 2024

  • CVE-2024-21545
    32İzleyin

    Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization.

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    proxmox · pve-manager24 Eyl 2024

  • CVE-2024-8877
    50Planlayın

    Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204.

    OrtaCVSS 6,9Kavram kanıtıEPSS %77

    riello-ups · netman 204 firmware24 Eyl 2024

  • CVE-2024-8349
    28İzleyin

    Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    uncannyowl · uncanny groups for learndash24 Eyl 2024

  • CVE-2024-8484
    31İzleyin

    REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    jianbo · rest api to miniprogram24 Eyl 2024

  • CVE-2024-8275
    54Planlayın

    The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %49

    stellarwp · the events calendar25 Eyl 2024

  • CVE-2024-6845
    21İzleyin

    SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    webdigit · chatbot with chatgpt25 Eyl 2024

  • CVE-2024-7479
    35İzleyin

    Improper signature verification of VPN driver installation in TeamViewer Remote Clients

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    teamviewer · remote full client25 Eyl 2024

  • CVE-2024-6592
    37İzleyin

    WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    watchguard · authentication gateway25 Eyl 2024

  • CVE-2024-20467
    34İzleyin

    A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, rem

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    cisco · ios xe25 Eyl 2024

  • CVE-2024-0132
    45Planlayın

    NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration

    YüksekCVSS 8,3Kavram kanıtıEPSS %40

    nvidia · nvidia container toolkit26 Eyl 2024

  • CVE-2024-6517
    24İzleyin

    Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSS

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    dotsquares · contact form 7 math captcha26 Eyl 2024

  • CVE-2024-46627
    37İzleyin

    Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.

    KritikCVSS 9,1Kavram kanıtıEPSS %4

    26 Eyl 2024

  • CVE-2024-9166
    37İzleyin

    OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    atelmo · atemio am 520 hd full hd satellite receiver26 Eyl 2024

  • CVE-2024-8118
    20İzleyin

    Grafana alerting wrong permission on datasource rule write endpoint

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    grafana · grafana26 Eyl 2024

  • CVE-2024-46628
    43Planlayın

    Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName paramet

    KritikCVSS 9,8İstismar yokEPSS %11

    tendacn · g3 firmware26 Eyl 2024

  • CVE-2024-47179
    35İzleyin

    RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    diygod · rsshub26 Eyl 2024

  • CVE-2024-6769
    33İzleyin

    Medium to High Integrity Privilege Escalation in Microsoft Windows

    YüksekCVSS 8,4Kavram kanıtıEPSS %1

    microsoft · windows 1026 Eyl 2024

  • CVE-2024-40506
    29İzleyin

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMHospitalit

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    openpetra · openpetra26 Eyl 2024

  • CVE-2024-40507
    29İzleyin

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMPersonnel.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    openpetra · openpetra26 Eyl 2024

  • CVE-2024-40508
    29İzleyin

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMConference

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    openpetra · openpetra26 Eyl 2024

  • CVE-2024-47076
    60Bu hafta

    libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server

    YüksekCVSS 8,6SilahlaştırılmışEPSS %79

    openprinting · libcupsfilters26 Eyl 2024

  • CVE-2024-47175
    60Bu hafta

    libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

    KritikCVSS 9,8SilahlaştırılmışEPSS %63

    openprinting · libppd26 Eyl 2024

  • CVE-2024-47176
    60Bu hafta

    cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source

    OrtaCVSS 5,3SilahlaştırılmışEPSS %50

    openprinting · cups-browsed26 Eyl 2024

  • CVE-2024-7714
    30İzleyin

    AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    ays-pro · chatgpt assistant27 Eyl 2024

  • CVE-2024-6931
    29İzleyin

    The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting

    OrtaCVSS 6,1İstismar yokEPSS %16

    stellarwp · the events calendar27 Eyl 2024

  • CVE-2024-40511
    29İzleyin

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmi

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    openpetra · openpetra27 Eyl 2024

  • CVE-2024-40512
    29İzleyin

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    openpetra · openpetra27 Eyl 2024

  • CVE-2024-40509
    29İzleyin

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asm

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    openpetra · openpetra27 Eyl 2024

  • CVE-2024-40510
    32İzleyin

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMCommon.asm

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    openpetra · openpetra27 Eyl 2024

  • CVE-2024-25411
    24İzleyin

    A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    flatpress · flatpress27 Eyl 2024

  • CVE-2024-25412
    24İzleyin

    A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    flatpress · flatpress27 Eyl 2024

  • CVE-2024-46256
    40Planlayın

    A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certi

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    jc21 · nginx proxy manager27 Eyl 2024

  • CVE-2024-8353
    60Bu hafta

    GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

    KritikCVSS 9,8SilahlaştırılmışEPSS %32

    givewp · givewp27 Eyl 2024

  • CVE-2024-9326
    27İzleyin

    PHPGurukul Online Shopping Portal Admin Panel index.php sql injection

    OrtaCVSS 6,9Kavram kanıtıEPSS %1

    phpgurukul · online shopping portal29 Eyl 2024

  • CVE-2024-45200
    25İzleyin

    In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based

    OrtaCVSS 6,3Kavram kanıtıEPSS %1

    30 Eyl 2024

  • CVE-2024-46635
    23İzleyin

    An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    30 Eyl 2024