By publication date

Exploited and new serious CVEs: August 2017

109 records · 6 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
38Monitor	CVE-2014-5302No exploit	Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9manageengine · servicedesk plus · CWE-22 RCE Path traversal	High8.8	—	10.7%	Aug 28, 2017
49Plan	CVE-2014-9312Weaponized	Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.10web · photo gallery · CWE-434 File upload	High8.8	—	45.3%	Aug 28, 2017
27Monitor	CVE-2017-3735No exploit	While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread.openssl · openssl · CWE-119 Pre-auth Memory safety	Medium5.3	—	20.9%	Aug 28, 2017
60This week	CVE-2017-13708Weaponized	Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GEvxsearch · vx search · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	11.7%	Aug 31, 2017
42Plan	CVE-2017-0899No exploit	RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.rubygems · rubygems · CWE-150 Pre-auth	Critical9.8	—	11.1%	Aug 31, 2017
39Monitor	CVE-2017-0901Proof of concept	RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any frubygems · rubygems · CWE-22 Pre-auth Path traversal	High7.5	—	29.4%	Aug 31, 2017
34Monitor	CVE-2014-8675Proof of concept	Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackerssoplanning · soplanning · CWE-200 Pre-auth Info leak	High7.5	—	12.5%	Aug 31, 2017
33Monitor	CVE-2014-8676Proof of concept	Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the soplanning · soplanning · CWE-22 Pre-auth Path traversal	Medium5.3	—	40.7%	Aug 31, 2017
60This week	CVE-2015-5958Weaponized	phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.phpfilemanager project · phpfilemanager · CWE-78 pre-auth RCE Command injection	High8.8	—	27.3%	Aug 31, 2017

CVE-2014-5302
38Monitor
Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9
HighCVSS 8.8No exploitEPSS 10%
- RCE
- Path traversal
manageengine · servicedesk plusAug 28, 2017
CVE-2014-9312
49Plan
Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
HighCVSS 8.8WeaponizedEPSS 45%
- File upload
10web · photo galleryAug 28, 2017
CVE-2017-3735
27Monitor
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread.
MediumCVSS 5.3No exploitEPSS 20%
- Pre-auth
- Memory safety
openssl · opensslAug 28, 2017
CVE-2017-13708
60This week
Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GE
CriticalCVSS 9.8WeaponizedEPSS 11%
- pre-auth RCE
- Memory safety
vxsearch · vx searchAug 31, 2017
CVE-2017-0899
42Plan
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.
CriticalCVSS 9.8No exploitEPSS 11%
- Pre-auth
rubygems · rubygemsAug 31, 2017
CVE-2017-0901
39Monitor
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any f
HighCVSS 7.5Proof of conceptEPSS 29%
- Pre-auth
- Path traversal
rubygems · rubygemsAug 31, 2017
CVE-2014-8675
34Monitor
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers
HighCVSS 7.5Proof of conceptEPSS 12%
- Pre-auth
- Info leak
soplanning · soplanningAug 31, 2017
CVE-2014-8676
33Monitor
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the
MediumCVSS 5.3Proof of conceptEPSS 40%
- Pre-auth
- Path traversal
soplanning · soplanningAug 31, 2017
CVE-2015-5958
60This week
phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.
HighCVSS 8.8WeaponizedEPSS 27%
- pre-auth RCE
- Command injection
phpfilemanager project · phpfilemanagerAug 31, 2017