By publication date

Exploited and new serious CVEs: August 2017

109 records · 6 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
26Monitor	CVE-2017-8572No exploit	Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allowsmicrosoft · outlook · CWE-200 Info leak	Medium5.5	—	12.5%	Aug 1, 2017
37Monitor	CVE-2017-8663No exploit	Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allowsmicrosoft · outlook · CWE-119 RCE Memory safety	High7.8	—	20.0%	Aug 1, 2017
44Plan	CVE-2015-2560No exploit	Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an azohocorp · manageengine desktop central · CWE-264 Pre-auth	Critical9.8	—	15.2%	Aug 2, 2017
65This week	CVE-2017-9769Weaponized	A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a razer · synapse Pre-auth	Critical9.8	—	85.5%	Aug 2, 2017
51Plan	CVE-2017-11383No exploit	SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input trendmicro · control manager · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	38.4%	Aug 2, 2017
51Plan	CVE-2017-11384No exploit	SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input trendmicro · control manager · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	38.4%	Aug 2, 2017
51Plan	CVE-2017-11385No exploit	SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input trendmicro · control manager · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	38.4%	Aug 2, 2017
46Plan	CVE-2017-11386No exploit	SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input trendmicro · control manager · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	24.1%	Aug 2, 2017
34Monitor	CVE-2017-11387No exploit	Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functitrendmicro · control manager · CWE-200 Pre-auth Auth bypass Info leak	High7.5	—	14.7%	Aug 2, 2017
39Monitor	CVE-2017-11388No exploit	SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate utrendmicro · control manager · CWE-89 RCE SQL injection	High8.8	—	14.1%	Aug 2, 2017
47Plan	CVE-2017-11389No exploit	Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files trendmicro · control manager · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	27.2%	Aug 2, 2017
47Plan	CVE-2017-7442Weaponized	Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.gonitro · nitro pro · CWE-22 pre-auth RCE Path traversal	High8.8	—	40.6%	Aug 3, 2017
54Plan	CVE-2017-11391Weaponized	Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute artrendmicro · interscan messaging security virtual appliance · CWE-77 RCE Command injection	High8.8	—	62.1%	Aug 3, 2017
45Plan	CVE-2017-11392Weaponized	Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute artrendmicro · interscan messaging security virtual appliance · CWE-77 RCE Command injection	High8.8	—	34.0%	Aug 3, 2017
44Plan	CVE-2017-11393No exploit	Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerabtrendmicro · officescan · CWE-20 pre-auth RCE Command injection	Critical9.8	—	15.8%	Aug 3, 2017
59Plan	CVE-2017-11394Weaponized	Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerabtrendmicro · officescan · CWE-20 pre-auth RCE Command injection	Critical9.8	—	66.7%	Aug 3, 2017
57Plan	CVE-2017-6663Weaponized	A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacentcisco · ios Pre-auth Denial of service	Medium6.5	KEV	2.1%	Aug 7, 2017
59Plan	CVE-2017-12477Weaponized	It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue inkaseya · unitrends backup · CWE-287 pre-auth RCE Auth bypass	Critical9.8	—	68.2%	Aug 7, 2017
62This week	CVE-2017-12478Weaponized	It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameterkaseya · unitrends backup · CWE-287 pre-auth RCE Auth bypass	Critical9.8	—	78.2%	Aug 7, 2017
39Monitor	CVE-2017-12479Proof of concept	It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable dukaseya · unitrends backup RCE	High8.8	—	11.8%	Aug 7, 2017
38Monitor	CVE-2014-9260Proof of concept	The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every Wordw3eden · download manager	High8.8	—	11.0%	Aug 7, 2017
33Monitor	CVE-2015-7704No exploit	The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of craftntp · ntp · CWE-20 Pre-auth Denial of service	High7.5	—	10.6%	Aug 7, 2017
43Plan	CVE-2015-7705No exploit	The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large nntp · ntp · CWE-20 Pre-auth	Critical9.8	—	12.1%	Aug 7, 2017
40Plan	CVE-2015-7849No exploit	Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execntp · ntp · CWE-416 RCE Memory safety	High8.8	—	16.8%	Aug 7, 2017
27Monitor	CVE-2015-7852No exploit	ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 rentp · ntp · CWE-20 Pre-auth Denial of service	Medium5.9	—	12.2%	Aug 7, 2017
43Plan	CVE-2015-7853No exploit	The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrantp · ntp · CWE-120 pre-auth RCE Memory safety	Critical9.8	—	11.7%	Aug 7, 2017
39Monitor	CVE-2015-7854No exploit	Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated usntp · ntp · CWE-120 RCE Memory safety	High8.8	—	14.5%	Aug 7, 2017
35Monitor	CVE-2015-7855Proof of concept	The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service ntp · ntp · CWE-20 Denial of service	Medium6.5	—	31.0%	Aug 7, 2017
64This week	CVE-2015-7871Weaponized	Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.ntp · ntp · CWE-287 Pre-auth Auth bypass	Critical9.8	—	81.7%	Aug 7, 2017
42Plan	CVE-2016-7976Weaponized	The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.artifex · ghostscript · CWE-20 pre-auth RCE	High8.8	—	23.4%	Aug 7, 2017
89Now	CVE-2017-12637Weaponized	Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allowssap · netweaver application server java · CWE-22 Pre-auth Path traversal	High7.5	KEV	95.1%	Aug 7, 2017
37Monitor	CVE-2017-10075Proof of concept	Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server).oracle · webcenter content Pre-auth	High8.2	—	17.5%	Aug 8, 2017
36Monitor	CVE-2017-10246Proof of concept	Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp).oracle · application object library Pre-auth	High8.2	—	13.9%	Aug 8, 2017
44Plan	CVE-2017-11151Proof of concept	A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrarysynology · photo station · CWE-287 Pre-auth Auth bypass	Critical9.8	—	16.2%	Aug 8, 2017
34Monitor	CVE-2017-11152Proof of concept	Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackerssynology · photo station · CWE-22 Pre-auth Path traversal	High7.5	—	14.5%	Aug 8, 2017
43Plan	CVE-2017-11153Proof of concept	Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers synology · photo station · CWE-502 Pre-auth Deserialization	Critical9.8	—	12.1%	Aug 8, 2017
44Plan	CVE-2017-11155Proof of concept	An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtaisynology · photo station · CWE-205 Pre-auth	High7.5	—	47.4%	Aug 8, 2017
38Monitor	CVE-2017-0250No exploit	Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RTmicrosoft · windows 10 · CWE-119 RCE Memory safety	High7.8	—	23.6%	Aug 8, 2017
34Monitor	CVE-2017-0293No exploit	Microsoft Windows PDF Library in Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, microsoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	14.4%	Aug 8, 2017
49Plan	CVE-2017-8620No exploit	Windows Search in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 1microsoft · windows 10 · CWE-119 pre-auth RCE Memory safety	High8.1	—	57.3%	Aug 8, 2017
40Plan	CVE-2017-8625Proof of concept	Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Intmicrosoft · internet explorer · CWE-276 Pre-auth	High8.8	—	15.2%	Aug 8, 2017
51Plan	CVE-2017-8634Proof of concept	Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way tmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	70.2%	Aug 8, 2017
47Plan	CVE-2017-8635Proof of concept	Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windomicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	55.8%	Aug 8, 2017
52Plan	CVE-2017-8636Proof of concept	Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windomicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	72.1%	Aug 8, 2017
51Plan	CVE-2017-8640Proof of concept	Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of microsoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	69.2%	Aug 8, 2017
51Plan	CVE-2017-8641Proof of concept	Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windomicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	71.6%	Aug 8, 2017
22Monitor	CVE-2017-8644Proof of concept	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to themicrosoft · edge · CWE-200 Pre-auth Info leak	Medium4.3	—	15.1%	Aug 8, 2017
51Plan	CVE-2017-8645Proof of concept	Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the cumicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	69.2%	Aug 8, 2017
51Plan	CVE-2017-8646Proof of concept	Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the cumicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	69.2%	Aug 8, 2017
33Monitor	CVE-2017-8652Proof of concept	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to themicrosoft · edge · CWE-200 Pre-auth Info leak	Medium6.5	—	22.9%	Aug 8, 2017
51Plan	CVE-2017-8656Proof of concept	Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of thmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	69.2%	Aug 8, 2017
46Plan	CVE-2017-8657Proof of concept	Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the contextmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	54.5%	Aug 8, 2017
51Plan	CVE-2017-8670Proof of concept	Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of thmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	68.7%	Aug 8, 2017
51Plan	CVE-2017-8671Proof of concept	Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the contextmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	69.2%	Aug 8, 2017
41Plan	CVE-2017-8691No exploit	Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font limicrosoft · windows 7 · CWE-119 pre-auth RCE Memory safety	High8.8	—	19.7%	Aug 8, 2017
46Plan	CVE-2015-0786No exploit	Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allnovell · zenworks configuration management · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	23.6%	Aug 9, 2017
64This week	CVE-2015-2291Weaponized	(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cintel · ethernet diagnostics driver iqvw32.sys · CWE-20 RCE Local privilege escalation	High7.8	KEV	9.0%	Aug 9, 2017
33Monitor	CVE-2017-8518No exploit	Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, aka "Scripting Engine Memory Corrumicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	10.2%	Aug 10, 2017
39Monitor	CVE-2016-5018No exploit	In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application apache · tomcat Pre-auth	Critical9.1	—	10.3%	Aug 10, 2017
35Monitor	CVE-2016-8745No exploit	A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.Rapache · tomcat · CWE-388 Pre-auth	High7.5	—	16.0%	Aug 10, 2017
45Plan	CVE-2017-8658No exploit	A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scrimicrosoft · chakracore · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	20.0%	Aug 10, 2017
33Monitor	CVE-2017-7675No exploit	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented dirapache · tomcat · CWE-22 Pre-auth Path traversal	High7.5	—	10.1%	Aug 10, 2017
29Monitor	CVE-2017-11209No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	Medium6.5	—	11.4%	Aug 11, 2017
29Monitor	CVE-2017-11210No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	Medium6.5	—	11.4%	Aug 11, 2017
43Plan	CVE-2017-11211No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	—	27.0%	Aug 11, 2017
39Monitor	CVE-2017-11220No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	—	14.6%	Aug 11, 2017
29Monitor	CVE-2017-11230No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	Medium6.5	—	10.0%	Aug 11, 2017
39Monitor	CVE-2017-11241No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	—	14.6%	Aug 11, 2017
29Monitor	CVE-2017-11244No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	Medium6.5	—	10.0%	Aug 11, 2017
39Monitor	CVE-2017-11259No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	—	12.7%	Aug 11, 2017
43Plan	CVE-2017-11263No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	—	26.0%	Aug 11, 2017
34Monitor	CVE-2017-11272No exploit	Adobe Digital Editions 4.5.4 and earlier has a security bypass vulnerability.adobe · digital editions · CWE-200 Pre-auth Info leak	High7.5	—	13.0%	Aug 11, 2017
42Plan	CVE-2017-3106Proof of concept	Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files.adobe · flash player desktop runtime · CWE-704 pre-auth RCE	High8.8	—	22.3%	Aug 11, 2017
41Plan	CVE-2017-3117No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	—	18.8%	Aug 11, 2017
39Monitor	CVE-2017-3123No exploit	Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expladobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	—	14.3%	Aug 11, 2017
76This week	CVE-2017-6327Weaponized	The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an indsymantec · message gateway · CWE-77 RCE Command injection	High8.8	KEV	35.9%	Aug 11, 2017
45Plan	CVE-2017-9800No exploit	A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alphaapache · subversion · CWE-20 Pre-auth	Critical9.8	—	18.8%	Aug 11, 2017
57Plan	CVE-2017-7546No exploit	PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackerspostgresql · postgresql · CWE-287 Pre-auth Auth bypass	Critical9.8	—	61.5%	Aug 16, 2017
33Monitor	CVE-2017-11661Proof of concept	The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and applicationmindwerks · wildmidi · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	10.7%	Aug 17, 2017
43Plan	CVE-2017-12936No exploit	The ReadWMFImage function in coders/wmf.c in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting.graphicsmagick · graphicsmagick · CWE-416 Pre-auth Memory safety	High8.8	—	25.0%	Aug 18, 2017
51Plan	CVE-2017-12943Proof of concept	D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolutedlink · dir-600 b1 firmware · CWE-22 Pre-auth Path traversal	Critical9.8	—	39.2%	Aug 18, 2017
34Monitor	CVE-2015-7944Proof of concept	The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.spi-inc · ganeti · CWE-399 Pre-auth Denial of service	High7.5	—	14.1%	Aug 18, 2017
32Monitor	CVE-2017-10661Proof of concept	Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list clinux · linux kernel · CWE-416 Local privilege escalation Memory safety Race condition	High7.0	—	13.3%	Aug 19, 2017
64This week	CVE-2015-2857Weaponized	Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oautaccellion · file transfer appliance · CWE-77 pre-auth RCE Command injection	Critical9.8	—	84.1%	Aug 22, 2017
44Plan	CVE-2017-12785Proof of concept	The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is pnoviflow · noviware · CWE-119 pre-auth RCE Command injection Memory safety	Critical9.8	—	15.9%	Aug 22, 2017
47Plan	CVE-2017-12786Proof of concept	Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed onoviflow · noviware · CWE-119 Pre-auth Memory safety	Critical9.8	—	25.2%	Aug 22, 2017
46Plan	CVE-2017-12787Proof of concept	A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deployenoviflow · noviware · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	24.6%	Aug 22, 2017
61This week	CVE-2017-11610Weaponized	The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated ussupervisord · supervisor · CWE-276 RCE	High8.8	—	87.3%	Aug 23, 2017
44Plan	CVE-2017-12965Proof of concept	Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.apache2triad · apache2triad · CWE-384 Pre-auth	Critical9.8	—	15.6%	Aug 23, 2017
94Now	CVE-2017-11317Weaponized	Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which atelerik · ui for asp.net ajax · CWE-326 pre-auth RCE File upload Weak crypto	Critical9.8	KEV	84.1%	Aug 23, 2017
92Now	CVE-2017-11357Weaponized	Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackeprogress · telerik ui for asp.net ajax · CWE-434 pre-auth RCE File upload	Critical9.8	KEV	77.6%	Aug 23, 2017
45Plan	CVE-2017-9506Proof of concept	The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allowsatlassian · oauth · CWE-918 Pre-auth SSRF XSS	Medium6.1	—	71.6%	Aug 23, 2017
39Monitor	CVE-2015-7258Proof of concept	ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by dizte · zxv10 w300 firmware · CWE-255	High8.8	—	12.8%	Aug 24, 2017
44Plan	CVE-2015-8352Proof of concept	Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a ..zen-cart · zen cart · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	15.6%	Aug 24, 2017
44Plan	CVE-2014-7857No exploit	D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05d-link · dns-322l firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	15.1%	Aug 25, 2017
44Plan	CVE-2014-7858No exploit	The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the ud-link · dnr-326 firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	15.1%	Aug 25, 2017
45Plan	CVE-2014-7859No exploit	Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-32d-link · dns-322l firmware · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	20.8%	Aug 25, 2017
33Monitor	CVE-2015-1395No exploit	Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to argnu · patch · CWE-22 Pre-auth Path traversal	High7.5	—	11.2%	Aug 25, 2017
33Monitor	CVE-2015-4181Proof of concept	Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a ..phpmybackuppro · phpmybackuppro · CWE-22 Pre-auth Path traversal	High7.5	—	11.5%	Aug 25, 2017
59Plan	CVE-2014-5301Weaponized	Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to manageengine · servicedesk plus · CWE-22 Path traversal	High8.8	—	78.3%	Aug 28, 2017

CVE-2017-8572
26Monitor
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows
MediumCVSS 5.5No exploitEPSS 12%
- Info leak
microsoft · outlookAug 1, 2017
CVE-2017-8663
37Monitor
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows
HighCVSS 7.8No exploitEPSS 20%
- RCE
- Memory safety
microsoft · outlookAug 1, 2017
CVE-2015-2560
44Plan
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an a
CriticalCVSS 9.8No exploitEPSS 15%
- Pre-auth
zohocorp · manageengine desktop centralAug 2, 2017
CVE-2017-9769
65This week
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a
CriticalCVSS 9.8WeaponizedEPSS 85%
- Pre-auth
razer · synapseAug 2, 2017
CVE-2017-11383
51Plan
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input
CriticalCVSS 9.8No exploitEPSS 38%
- pre-auth RCE
- SQL injection
trendmicro · control managerAug 2, 2017
CVE-2017-11384
51Plan
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input
CriticalCVSS 9.8No exploitEPSS 38%
- pre-auth RCE
- SQL injection
trendmicro · control managerAug 2, 2017
CVE-2017-11385
51Plan
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input
CriticalCVSS 9.8No exploitEPSS 38%
- pre-auth RCE
- SQL injection
trendmicro · control managerAug 2, 2017
CVE-2017-11386
46Plan
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input
CriticalCVSS 9.8No exploitEPSS 24%
- pre-auth RCE
- SQL injection
trendmicro · control managerAug 2, 2017
CVE-2017-11387
34Monitor
Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functi
HighCVSS 7.5No exploitEPSS 14%
- Pre-auth
- Auth bypass
- Info leak
trendmicro · control managerAug 2, 2017
CVE-2017-11388
39Monitor
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate u
HighCVSS 8.8No exploitEPSS 14%
- RCE
- SQL injection
trendmicro · control managerAug 2, 2017
CVE-2017-11389
47Plan
Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files
CriticalCVSS 9.8No exploitEPSS 27%
- pre-auth RCE
- Path traversal
trendmicro · control managerAug 2, 2017
CVE-2017-7442
47Plan
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
HighCVSS 8.8WeaponizedEPSS 40%
- pre-auth RCE
- Path traversal
gonitro · nitro proAug 3, 2017
CVE-2017-11391
54Plan
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute ar
HighCVSS 8.8WeaponizedEPSS 62%
- RCE
- Command injection
trendmicro · interscan messaging security virtual applianceAug 3, 2017
CVE-2017-11392
45Plan
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute ar
HighCVSS 8.8WeaponizedEPSS 34%
- RCE
- Command injection
trendmicro · interscan messaging security virtual applianceAug 3, 2017
CVE-2017-11393
44Plan
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerab
CriticalCVSS 9.8No exploitEPSS 15%
- pre-auth RCE
- Command injection
trendmicro · officescanAug 3, 2017
CVE-2017-11394
59Plan
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerab
CriticalCVSS 9.8WeaponizedEPSS 66%
- pre-auth RCE
- Command injection
trendmicro · officescanAug 3, 2017
CVE-2017-6663
57Plan
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent
MediumCVSS 6.5KEVWeaponizedEPSS 2%
- Pre-auth
- Denial of service
cisco · iosAug 7, 2017
CVE-2017-12477
59Plan
It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in
CriticalCVSS 9.8WeaponizedEPSS 68%
- pre-auth RCE
- Auth bypass
kaseya · unitrends backupAug 7, 2017
CVE-2017-12478
62This week
It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameter
CriticalCVSS 9.8WeaponizedEPSS 78%
- pre-auth RCE
- Auth bypass
kaseya · unitrends backupAug 7, 2017
CVE-2017-12479
39Monitor
It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable du
HighCVSS 8.8Proof of conceptEPSS 11%
- RCE
kaseya · unitrends backupAug 7, 2017
CVE-2014-9260
38Monitor
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every Word
HighCVSS 8.8Proof of conceptEPSS 11%
w3eden · download managerAug 7, 2017
CVE-2015-7704
33Monitor
The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of craft
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
- Denial of service
ntp · ntpAug 7, 2017
CVE-2015-7705
43Plan
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large n
CriticalCVSS 9.8No exploitEPSS 12%
- Pre-auth
ntp · ntpAug 7, 2017
CVE-2015-7849
40Plan
Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly exec
HighCVSS 8.8No exploitEPSS 16%
- RCE
- Memory safety
ntp · ntpAug 7, 2017
CVE-2015-7852
27Monitor
ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 re
MediumCVSS 5.9No exploitEPSS 12%
- Pre-auth
- Denial of service
ntp · ntpAug 7, 2017
CVE-2015-7853
43Plan
The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitra
CriticalCVSS 9.8No exploitEPSS 11%
- pre-auth RCE
- Memory safety
ntp · ntpAug 7, 2017
CVE-2015-7854
39Monitor
Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated us
HighCVSS 8.8No exploitEPSS 14%
- RCE
- Memory safety
ntp · ntpAug 7, 2017
CVE-2015-7855
35Monitor
The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service
MediumCVSS 6.5Proof of conceptEPSS 31%
- Denial of service
ntp · ntpAug 7, 2017
CVE-2015-7871
64This week
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
CriticalCVSS 9.8WeaponizedEPSS 81%
- Pre-auth
- Auth bypass
ntp · ntpAug 7, 2017
CVE-2016-7976
42Plan
The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
HighCVSS 8.8WeaponizedEPSS 23%
- pre-auth RCE
artifex · ghostscriptAug 7, 2017
CVE-2017-12637
89Now
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows
HighCVSS 7.5KEVWeaponizedEPSS 95%
- Pre-auth
- Path traversal
sap · netweaver application server javaAug 7, 2017
CVE-2017-10075
37Monitor
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server).
HighCVSS 8.2Proof of conceptEPSS 17%
- Pre-auth
oracle · webcenter contentAug 8, 2017
CVE-2017-10246
36Monitor
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp).
HighCVSS 8.2Proof of conceptEPSS 13%
- Pre-auth
oracle · application object libraryAug 8, 2017
CVE-2017-11151
44Plan
A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary
CriticalCVSS 9.8Proof of conceptEPSS 16%
- Pre-auth
- Auth bypass
synology · photo stationAug 8, 2017
CVE-2017-11152
34Monitor
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers
HighCVSS 7.5Proof of conceptEPSS 14%
- Pre-auth
- Path traversal
synology · photo stationAug 8, 2017
CVE-2017-11153
43Plan
Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers
CriticalCVSS 9.8Proof of conceptEPSS 12%
- Pre-auth
- Deserialization
synology · photo stationAug 8, 2017
CVE-2017-11155
44Plan
An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtai
HighCVSS 7.5Proof of conceptEPSS 47%
- Pre-auth
synology · photo stationAug 8, 2017
CVE-2017-0250
38Monitor
Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
HighCVSS 7.8No exploitEPSS 23%
- RCE
- Memory safety
microsoft · windows 10Aug 8, 2017
CVE-2017-0293
34Monitor
Microsoft Windows PDF Library in Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold,
HighCVSS 7.5No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8620
49Plan
Windows Search in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 1
HighCVSS 8.1No exploitEPSS 57%
- pre-auth RCE
- Memory safety
microsoft · windows 10Aug 8, 2017
CVE-2017-8625
40Plan
Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Int
HighCVSS 8.8Proof of conceptEPSS 15%
- Pre-auth
microsoft · internet explorerAug 8, 2017
CVE-2017-8634
51Plan
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way t
HighCVSS 7.5Proof of conceptEPSS 70%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8635
47Plan
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo
HighCVSS 7.5Proof of conceptEPSS 55%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 8, 2017
CVE-2017-8636
52Plan
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo
HighCVSS 7.5Proof of conceptEPSS 72%
- pre-auth RCE
- Memory safety
microsoft · internet explorerAug 8, 2017
CVE-2017-8640
51Plan
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of
HighCVSS 7.5Proof of conceptEPSS 69%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8641
51Plan
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo
HighCVSS 7.5Proof of conceptEPSS 71%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8644
22Monitor
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the
MediumCVSS 4.3Proof of conceptEPSS 15%
- Pre-auth
- Info leak
microsoft · edgeAug 8, 2017
CVE-2017-8645
51Plan
Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the cu
HighCVSS 7.5Proof of conceptEPSS 69%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8646
51Plan
Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the cu
HighCVSS 7.5Proof of conceptEPSS 69%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8652
33Monitor
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the
MediumCVSS 6.5Proof of conceptEPSS 22%
- Pre-auth
- Info leak
microsoft · edgeAug 8, 2017
CVE-2017-8656
51Plan
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of th
HighCVSS 7.5Proof of conceptEPSS 69%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8657
46Plan
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context
HighCVSS 7.5Proof of conceptEPSS 54%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8670
51Plan
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of th
HighCVSS 7.5Proof of conceptEPSS 68%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8671
51Plan
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context
HighCVSS 7.5Proof of conceptEPSS 69%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 8, 2017
CVE-2017-8691
41Plan
Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font li
HighCVSS 8.8No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · windows 7Aug 8, 2017
CVE-2015-0786
46Plan
Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) all
CriticalCVSS 9.8No exploitEPSS 23%
- pre-auth RCE
- Memory safety
novell · zenworks configuration managementAug 9, 2017
CVE-2015-2291
64This week
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to c
HighCVSS 7.8KEVWeaponizedEPSS 9%
- RCE
- Local privilege escalation
intel · ethernet diagnostics driver iqvw32.sysAug 9, 2017
CVE-2017-8518
33Monitor
Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, aka "Scripting Engine Memory Corru
HighCVSS 7.5No exploitEPSS 10%
- pre-auth RCE
- Memory safety
microsoft · edgeAug 10, 2017
CVE-2016-5018
39Monitor
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application
CriticalCVSS 9.1No exploitEPSS 10%
- Pre-auth
apache · tomcatAug 10, 2017
CVE-2016-8745
35Monitor
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.R
HighCVSS 7.5No exploitEPSS 16%
- Pre-auth
apache · tomcatAug 10, 2017
CVE-2017-8658
45Plan
A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scri
CriticalCVSS 9.8No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · chakracoreAug 10, 2017
CVE-2017-7675
33Monitor
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented dir
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
- Path traversal
apache · tomcatAug 10, 2017
CVE-2017-11209
29Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
MediumCVSS 6.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11210
29Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
MediumCVSS 6.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11211
43Plan
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
HighCVSS 8.8No exploitEPSS 27%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11220
39Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11230
29Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
MediumCVSS 6.5No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11241
39Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11244
29Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
MediumCVSS 6.5No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11259
39Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
HighCVSS 8.8No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11263
43Plan
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
HighCVSS 8.8No exploitEPSS 26%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-11272
34Monitor
Adobe Digital Editions 4.5.4 and earlier has a security bypass vulnerability.
HighCVSS 7.5No exploitEPSS 13%
- Pre-auth
- Info leak
adobe · digital editionsAug 11, 2017
CVE-2017-3106
42Plan
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files.
HighCVSS 8.8Proof of conceptEPSS 22%
- pre-auth RCE
adobe · flash player desktop runtimeAug 11, 2017
CVE-2017-3117
41Plan
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-3123
39Monitor
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
- Memory safety
adobe · acrobatAug 11, 2017
CVE-2017-6327
76This week
The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an ind
HighCVSS 8.8KEVWeaponizedEPSS 35%
- RCE
- Command injection
symantec · message gatewayAug 11, 2017
CVE-2017-9800
45Plan
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha
CriticalCVSS 9.8No exploitEPSS 18%
- Pre-auth
apache · subversionAug 11, 2017
CVE-2017-7546
57Plan
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers
CriticalCVSS 9.8No exploitEPSS 61%
- Pre-auth
- Auth bypass
postgresql · postgresqlAug 16, 2017
CVE-2017-11661
33Monitor
The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application
HighCVSS 7.5Proof of conceptEPSS 10%
- Pre-auth
- Memory safety
- Denial of service
mindwerks · wildmidiAug 17, 2017
CVE-2017-12936
43Plan
The ReadWMFImage function in coders/wmf.c in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting.
HighCVSS 8.8No exploitEPSS 25%
- Pre-auth
- Memory safety
graphicsmagick · graphicsmagickAug 18, 2017
CVE-2017-12943
51Plan
D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute
CriticalCVSS 9.8Proof of conceptEPSS 39%
- Pre-auth
- Path traversal
dlink · dir-600 b1 firmwareAug 18, 2017
CVE-2015-7944
34Monitor
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.
HighCVSS 7.5Proof of conceptEPSS 14%
- Pre-auth
- Denial of service
spi-inc · ganetiAug 18, 2017
CVE-2017-10661
32Monitor
Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list c
HighCVSS 7.0Proof of conceptEPSS 13%
- Local privilege escalation
- Memory safety
- Race condition
linux · linux kernelAug 19, 2017
CVE-2015-2857
64This week
Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oaut
CriticalCVSS 9.8WeaponizedEPSS 84%
- pre-auth RCE
- Command injection
accellion · file transfer applianceAug 22, 2017
CVE-2017-12785
44Plan
The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is p
CriticalCVSS 9.8Proof of conceptEPSS 15%
- pre-auth RCE
- Command injection
- Memory safety
noviflow · noviwareAug 22, 2017
CVE-2017-12786
47Plan
Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed o
CriticalCVSS 9.8Proof of conceptEPSS 25%
- Pre-auth
- Memory safety
noviflow · noviwareAug 22, 2017
CVE-2017-12787
46Plan
A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deploye
CriticalCVSS 9.8Proof of conceptEPSS 24%
- pre-auth RCE
- Memory safety
noviflow · noviwareAug 22, 2017
CVE-2017-11610
61This week
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated us
HighCVSS 8.8WeaponizedEPSS 87%
- RCE
supervisord · supervisorAug 23, 2017
CVE-2017-12965
44Plan
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CriticalCVSS 9.8Proof of conceptEPSS 15%
- Pre-auth
apache2triad · apache2triadAug 23, 2017
CVE-2017-11317
94Now
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which a
CriticalCVSS 9.8KEVWeaponizedEPSS 84%
- pre-auth RCE
- File upload
- Weak crypto
telerik · ui for asp.net ajaxAug 23, 2017
CVE-2017-11357
92Now
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attacke
CriticalCVSS 9.8KEVWeaponizedEPSS 77%
- pre-auth RCE
- File upload
progress · telerik ui for asp.net ajaxAug 23, 2017
CVE-2017-9506
45Plan
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows
MediumCVSS 6.1Proof of conceptEPSS 71%
- Pre-auth
- SSRF
- XSS
atlassian · oauthAug 23, 2017
CVE-2015-7258
39Monitor
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by di
HighCVSS 8.8Proof of conceptEPSS 12%
zte · zxv10 w300 firmwareAug 24, 2017
CVE-2015-8352
44Plan
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a ..
CriticalCVSS 9.8Proof of conceptEPSS 15%
- pre-auth RCE
- Path traversal
zen-cart · zen cartAug 24, 2017
CVE-2014-7857
44Plan
D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05
CriticalCVSS 9.8No exploitEPSS 15%
- Pre-auth
- Auth bypass
d-link · dns-322l firmwareAug 25, 2017
CVE-2014-7858
44Plan
The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the u
CriticalCVSS 9.8No exploitEPSS 15%
- Pre-auth
- Auth bypass
d-link · dnr-326 firmwareAug 25, 2017
CVE-2014-7859
45Plan
Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-32
CriticalCVSS 9.8No exploitEPSS 20%
- pre-auth RCE
- Memory safety
d-link · dns-322l firmwareAug 25, 2017
CVE-2015-1395
33Monitor
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to ar
HighCVSS 7.5No exploitEPSS 11%
- Pre-auth
- Path traversal
gnu · patchAug 25, 2017
CVE-2015-4181
33Monitor
Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a ..
HighCVSS 7.5Proof of conceptEPSS 11%
- Pre-auth
- Path traversal
phpmybackuppro · phpmybackupproAug 25, 2017
CVE-2014-5301
59Plan
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to
HighCVSS 8.8WeaponizedEPSS 78%
- Path traversal
manageengine · servicedesk plusAug 28, 2017