İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2024: sömürülen ve yeni ciddi CVE kayıtları

155 kayıt · 11 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2024-12356
    95Hemen

    Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %87

    beyondtrust · privileged remote access17 Ara 2024

  • CVE-2024-50379
    49Planlayın

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

    KritikCVSS 9,8Kavram kanıtıEPSS %31

    apache · tomcat17 Ara 2024

  • CVE-2024-12025
    31İzleyin

    Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    robfelty · collapsing categories18 Ara 2024

  • CVE-2024-21546
    35İzleyin

    Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimety

    YüksekCVSS 8,9Kavram kanıtıEPSS %1

    18 Ara 2024

  • CVE-2024-56058
    40Planlayın

    WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    denniskravetstns · vrpconnector18 Ara 2024

  • CVE-2024-56059
    40Planlayın

    WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    farinspace · partners18 Ara 2024

  • CVE-2023-34990
    46Planlayın

    A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized c

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    fortinet · fortiwlm18 Ara 2024

  • CVE-2024-54383
    39İzleyin

    WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    wpwebelite · woocommerce pdf vouchers18 Ara 2024

  • CVE-2024-12686
    62Bu hafta

    Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %13

    beyondtrust · privileged remote access18 Ara 2024

  • CVE-2024-56145
    96Hemen

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %97

    craftcms · craft cms18 Ara 2024

  • CVE-2024-56115
    24İzleyin

    A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    amiro · amiro.cms18 Ara 2024

  • CVE-2024-56116
    35İzleyin

    A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    amiro · amiro.cms18 Ara 2024

  • CVE-2024-11740
    30İzleyin

    Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution

    YüksekCVSS 7,3Kavram kanıtıEPSS %1

    w3eden · download manager19 Ara 2024

  • CVE-2024-11616
    22İzleyin

    Double-fetch heap overflow

    OrtaCVSS 5,6Kavram kanıtıEPSS %0

    netskope inc. · endpoint dlp19 Ara 2024

  • CVE-2021-26102
    42Planlayın

    A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated

    KritikCVSS 9,1Kavram kanıtıEPSS %19

    fortinet · fortiwan19 Ara 2024

  • CVE-2024-38819
    47Planlayın

    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks

    YüksekCVSS 7,5Kavram kanıtıEPSS %56

    19 Ara 2024

  • CVE-2024-56159
    31İzleyin

    Server source code is exposed to the public if sourcemaps are enabled

    YüksekCVSS 7,8Kavram kanıtıEPSS %1

    astro · astro19 Ara 2024

  • CVE-2024-52794
    24İzleyin

    Magnific lightbox susceptible to Cross-site Scripting in Discourse

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    discourse · discourse19 Ara 2024

  • CVE-2024-53991
    32İzleyin

    Potential Backup file leaked via Nginx in Discourse

    OrtaCVSS 5,9Kavram kanıtıEPSS %29

    discourse · discourse19 Ara 2024

  • CVE-2024-12729
    35İzleyin

    A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older tha

    YüksekCVSS 8,8İstismar yokEPSS %1

    sophos · firewall firmware19 Ara 2024

  • CVE-2024-56348
    17İzleyin

    In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    jetbrains · teamcity20 Ara 2024

  • CVE-2024-56331
    28İzleyin

    Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor

    OrtaCVSS 6,8Kavram kanıtıEPSS %1

    louislam · uptime-kuma20 Ara 2024

  • CVE-2024-12558
    26İzleyin

    WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_expo

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    puckrobin · wp base booking of appointments, services and events21 Ara 2024

  • CVE-2024-51463
    21İzleyin

    IBM i server-side request forgery

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    ibm · i21 Ara 2024

  • CVE-2024-51464
    17İzleyin

    IBM i authentication bypass

    OrtaCVSS 4,3Kavram kanıtıEPSS %1

    ibm · i21 Ara 2024

  • CVE-2024-45387
    48Planlayın

    Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

    YüksekCVSS 8,8İstismar yokEPSS %42

    apache · traffic control23 Ara 2024

  • CVE-2024-55947
    57Planlayın

    Gogs has a Path Traversal in file update API

    YüksekCVSS 8,7Kavram kanıtıEPSS %77

    gogs · gogs23 Ara 2024

  • CVE-2024-53961
    36İzleyin

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    YüksekCVSS 8,1İstismar yokEPSS %14

    adobe · coldfusion23 Ara 2024

  • CVE-2024-12594
    35İzleyin

    ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    zia-imtiaz · login page styler – custom wordpress login page customizer & security24 Ara 2024

  • CVE-2024-43441
    61Bu hafta

    Apache HugeGraph-Server: Fixed JWT Token(Secret)

    KritikCVSS 9,8Kavram kanıtıEPSS %72

    apache · hugegraph24 Ara 2024

  • CVE-2024-53150
    58Planlayın

    ALSA: usb-audio: Fix out of bounds reads when finding clock sources

    YüksekCVSS 7,1KEVSilahlaştırılmışEPSS %1

    linux · linux kernel24 Ara 2024

  • CVE-2024-10858
    24İzleyin

    Jetpack 13.0-14.0 - Unauthenticated DOM-XSS

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    automattic · jetpack25 Ara 2024

  • CVE-2024-52046
    47Planlayın

    Apache MINA: MINA applications using unbounded deserialization may allow RCE

    KritikCVSS 10,0İstismar yokEPSS %24

    apache · mina25 Ara 2024

  • CVE-2024-56431
    40Planlayın

    oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    xiph · theora25 Ara 2024

  • CVE-2024-56433
    14İzleyin

    shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user

    DüşükCVSS 3,6Kavram kanıtıEPSS %0

    shadow-maint · shadow-utils26 Ara 2024

  • CVE-2024-12955
    27İzleyin

    PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    phpgurukul · blood bank \& donor management system26 Ara 2024

  • CVE-2024-11605
    19İzleyin

    WP Publications <= 1.2 - Admin+ Stored XSS

    OrtaCVSS 4,8Kavram kanıtıEPSS %1

    wp-publications project · wp-publications27 Ara 2024

  • CVE-2024-11921
    19İzleyin

    Give < 3.19.0 - Reflected XSS

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    givewp · givewp27 Ara 2024

  • CVE-2024-3393
    73Bu hafta

    PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %29

    paloaltonetworks · pan-os27 Ara 2024

  • CVE-2024-53197
    62Bu hafta

    ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %4

    linux · linux kernel27 Ara 2024

  • CVE-2024-12856
    53Planlayın

    Four-Faith Industrial Router adjust_sys_time OS Command Injection

    YüksekCVSS 7,2Kavram kanıtıEPSS %84

    four-faith · f3x36 firmware27 Ara 2024

  • CVE-2024-12986
    38İzleyin

    DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection

    OrtaCVSS 6,9Kavram kanıtıEPSS %35

    draytek · vigor300b firmware27 Ara 2024

  • CVE-2024-12987
    86Hemen

    DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection

    OrtaCVSS 6,9KEVSilahlaştırılmışEPSS %98

    draytek · vigor300b firmware27 Ara 2024

  • CVE-2024-50944
    39İzleyin

    Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    27 Ara 2024

  • CVE-2024-50945
    30İzleyin

    An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submi

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    27 Ara 2024

  • CVE-2024-53476
    23İzleyin

    A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory rest

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    27 Ara 2024

  • CVE-2024-56512
    9İzleyin

    Apache NiFi: Missing Complete Authorization for Parameter and Service References

    DüşükCVSS 2,1Kavram kanıtıEPSS %3

    apache · nifi28 Ara 2024

  • CVE-2024-12828
    45Planlayın

    Webmin CGI Command Injection Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %33

    webmin · webmin30 Ara 2024

  • CVE-2024-56800
    29İzleyin

    Firecrawl has SSRF Vulnerability via malicious scrape target

    YüksekCVSS 7,4Kavram kanıtıEPSS %0

    mendableai · firecrawl30 Ara 2024

  • CVE-2024-56801
    27İzleyin

    Tasklists has Blind SQL Injection in /ajax/reorder.php

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    infotel · tasklists30 Ara 2024

  • CVE-2024-11972
    57Planlayın

    Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

    KritikCVSS 9,8Kavram kanıtıEPSS %59

    themehunk · hunk companion31 Ara 2024

  • CVE-2024-12105
    39İzleyin

    WhatsUp Gold - SnmpExtendedActiveMonitor path traversal

    OrtaCVSS 6,5İstismar yokEPSS %41

    progress · whatsup gold31 Ara 2024

  • CVE-2024-56064
    50Planlayın

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

    KritikCVSS 10,0Kavram kanıtıEPSS %33

    azzaroco · wp superbackup31 Ara 2024

  • CVE-2024-56067
    34İzleyin

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    azzaroco · wp superbackup31 Ara 2024

  • CVE-2024-56071
    39İzleyin

    WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    mikeleembruggen · simple dashboard31 Ara 2024