Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2017

100 records · 13 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2017-14103
    44Plan

    The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain

    HighCVSS 8.8No exploitEPSS 30%

    graphicsmagick · graphicsmagickSep 1, 2017

  • CVE-2017-3897
    43Plan

    A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    mcafee · livesafeSep 1, 2017

  • CVE-2017-14098
    45Plan

    In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, o

    HighCVSS 7.5No exploitEPSS 50%

    digium · asteriskSep 2, 2017

  • CVE-2017-14100
    43Plan

    In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before

    CriticalCVSS 9.8No exploitEPSS 14%

    digium · asteriskSep 2, 2017

  • CVE-2017-14117
    60This week

    The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenti

    MediumCVSS 5.9WeaponizedEPSS 8%

    att · u-verse firmwareSep 3, 2017

  • CVE-2017-14135
    46Plan

    enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execut

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    dreambox · opendreamboxSep 4, 2017

  • CVE-2017-1000083
    46Plan

    backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary com

    HighCVSS 7.8WeaponizedEPSS 51%

    gnome · evinceSep 5, 2017

  • CVE-2017-1129
    60This week

    IBM Notes 8.5 and 9.0 is vulnerable to a denial of service.

    MediumCVSS 6.5WeaponizedEPSS 30%

    ibm · inotesSep 5, 2017

  • CVE-2017-1130
    60This week

    IBM Notes 8.5 and 9.0 is vulnerable to a denial of service.

    MediumCVSS 6.5WeaponizedEPSS 29%

    ibm · inotesSep 5, 2017

  • CVE-2015-7241
    43Plan

    XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    sap · netweaverSep 6, 2017

  • CVE-2017-12794
    31Monitor

    In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 d

    MediumCVSS 6.1Proof of conceptEPSS 23%

    djangoproject · djangoSep 7, 2017

  • CVE-2017-14147
    59Plan

    An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a route

    CriticalCVSS 9.8Proof of conceptEPSS 65%

    fiberhome · adsl an1020-25 firmwareSep 7, 2017

  • CVE-2017-6627
    62This week

    A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, re

    HighCVSS 7.5KEVWeaponizedEPSS 6%

    cisco · iosSep 7, 2017

  • CVE-2015-8351
    47Plan

    PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows

    CriticalCVSS 9.0Proof of conceptEPSS 37%

    gwolle guestbook project · gwolle guestbookSep 11, 2017

  • CVE-2017-3133
    27Monitor

    A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or command

    MediumCVSS 6.1Proof of conceptEPSS 10%

    fortinet · fortiosSep 11, 2017

  • CVE-2017-14335
    38Monitor

    On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Securi

    HighCVSS 7.5Proof of conceptEPSS 27%

    hbgk · hb7024xt firmwareSep 12, 2017

  • CVE-2017-1000251
    37Monitor

    The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vuln

    HighCVSS 8.0Proof of conceptEPSS 16%

    linux · linux kernelSep 12, 2017

  • CVE-2017-0161
    35Monitor

    The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a

    HighCVSS 8.1No exploitEPSS 11%

    microsoft · windows 10Sep 12, 2017

  • CVE-2017-11764
    49Plan

    Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of th

    HighCVSS 7.5Proof of conceptEPSS 64%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8567
    37Monitor

    A remote code execution vulnerability exists in Microsoft Excel for Mac 2011 when it fails to properly handle objects in memory, aka "Micros

    HighCVSS 7.8No exploitEPSS 20%

    microsoft · excel for macSep 12, 2017

  • CVE-2017-8630
    37Monitor

    Microsoft Office 2016 allows a remote code execution vulnerability when it fails to properly handle objects in memory, aka "Microsoft Office

    HighCVSS 7.8No exploitEPSS 21%

    microsoft · officeSep 12, 2017

  • CVE-2017-8631
    36Monitor

    A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Mi

    HighCVSS 7.8No exploitEPSS 16%

    microsoft · excelSep 12, 2017

  • CVE-2017-8632
    36Monitor

    A remote code execution vulnerability exists in Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 20

    HighCVSS 7.8No exploitEPSS 17%

    microsoft · excelSep 12, 2017

  • CVE-2017-8660
    38Monitor

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    HighCVSS 8.8No exploitEPSS 10%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8676
    17Monitor

    The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012

    LowCVSS 3.3No exploitEPSS 14%

    microsoft · live meetingSep 12, 2017

  • CVE-2017-8682
    50Plan

    Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.

    HighCVSS 8.8Proof of conceptEPSS 49%

    microsoft · office 2007Sep 12, 2017

  • CVE-2017-8683
    29Monitor

    Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.

    MediumCVSS 5.5Proof of conceptEPSS 22%

    microsoft · windows 10Sep 12, 2017

  • CVE-2017-8686
    47Plan

    The Windows Server DHCP service in Windows Server 2012 Gold and R2, and Windows Server 2016 allows an attacker to either run arbitrary code

    CriticalCVSS 9.8No exploitEPSS 27%

    microsoft · windows server 2012Sep 12, 2017

  • CVE-2017-8692
    35Monitor

    The Windows Uniscribe component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · windows 10Sep 12, 2017

  • CVE-2017-8696
    34Monitor

    Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · live meetingSep 12, 2017

  • CVE-2017-8699
    34Monitor

    Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window

    HighCVSS 7.0No exploitEPSS 21%

    microsoft · windows 10Sep 12, 2017

  • CVE-2017-8710
    25Monitor

    The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbit

    MediumCVSS 5.5No exploitEPSS 10%

    microsoft · windows 7Sep 12, 2017

  • CVE-2017-8725
    37Monitor

    A remote code execution vulnerability exists in Microsoft Publisher 2007 Service Pack 3 and Microsoft Publisher 2010 Service Pack 2 when the

    HighCVSS 7.8No exploitEPSS 20%

    microsoft · publisherSep 12, 2017

  • CVE-2017-8728
    36Monitor

    Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, an

    HighCVSS 7.5No exploitEPSS 21%

    microsoft · windows 8.1Sep 12, 2017

  • CVE-2017-8729
    52Plan

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way

    HighCVSS 7.5Proof of conceptEPSS 72%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8731
    45Plan

    Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curre

    HighCVSS 7.5Proof of conceptEPSS 51%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8734
    46Plan

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the c

    HighCVSS 7.5Proof of conceptEPSS 52%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8737
    36Monitor

    Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, an

    HighCVSS 7.5No exploitEPSS 21%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8740
    52Plan

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way

    HighCVSS 7.5Proof of conceptEPSS 72%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8741
    34Monitor

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    HighCVSS 7.5No exploitEPSS 11%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8742
    38Monitor

    A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, Microsof

    HighCVSS 7.8No exploitEPSS 22%

    microsoft · office compatibility packSep 12, 2017

  • CVE-2017-8743
    38Monitor

    A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016, and Office Online Se

    HighCVSS 7.8No exploitEPSS 22%

    microsoft · office online serverSep 12, 2017

  • CVE-2017-8744
    36Monitor

    A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Mi

    HighCVSS 7.8No exploitEPSS 17%

    microsoft · officeSep 12, 2017

  • CVE-2017-8747
    33Monitor

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · internet explorerSep 12, 2017

  • CVE-2017-8748
    34Monitor

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Micros

    HighCVSS 7.5No exploitEPSS 11%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8749
    33Monitor

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · internet explorerSep 12, 2017

  • CVE-2017-8751
    45Plan

    Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way tha

    HighCVSS 7.5Proof of conceptEPSS 50%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8755
    51Plan

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    HighCVSS 7.5Proof of conceptEPSS 71%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8757
    35Monitor

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the c

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · edgeSep 12, 2017

  • CVE-2017-8759
    88Now

    Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious docume

    HighCVSS 7.8KEVWeaponizedEPSS 88%

    microsoft · .net frameworkSep 12, 2017

  • CVE-2017-1002000
    47Plan

    Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    mobile-friendly-app-builder-by-easytouch project · mobile-friendly-app-builder-by-easytouchSep 14, 2017

  • CVE-2017-1002001
    42Plan

    Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://w

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    mobile-app-builder-by-wappress project · mobile-app-builder-by-wappressSep 14, 2017

  • CVE-2017-1002002
    43Plan

    Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    webapp-builder project · webapp-builderSep 14, 2017

  • CVE-2017-1002003
    43Plan

    Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software fr

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    wp2android-turn-wp-site-into-android-app project · wp2android-turn-wp-site-into-android-appSep 14, 2017

  • CVE-2017-1002008
    44Plan

    Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    membership simplified project · membership simplifiedSep 14, 2017

  • CVE-2017-13067
    60This week

    QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and

    CriticalCVSS 9.8WeaponizedEPSS 16%

    qnap · qtsSep 14, 2017

  • CVE-2017-0781
    42Plan

    A remote code execution vulnerability in the Android system (bluetooth).

    HighCVSS 8.8Proof of conceptEPSS 22%

    google · androidSep 14, 2017

  • CVE-2017-0785
    30Monitor

    A information disclosure vulnerability in the Android system (bluetooth).

    MediumCVSS 6.5Proof of conceptEPSS 12%

    google · androidSep 14, 2017

  • CVE-2017-9805
    92Now

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · strutsSep 15, 2017

  • CVE-2014-9463
    39Monitor

    functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer

    HighCVSS 8.8Proof of conceptEPSS 14%

    vbseo · vbseoSep 15, 2017

  • CVE-2017-14502
    31Monitor

    read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, lead

    HighCVSS 7.5No exploitEPSS 3%

    libarchive · libarchiveSep 17, 2017

  • CVE-2017-14243
    43Plan

    An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    utstar · wa3002g4 firmwareSep 17, 2017

  • CVE-2017-14244
    44Plan

    An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directl

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    iball · ib-wra150n firmwareSep 17, 2017

  • CVE-2017-9798
    60This week

    Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o

    HighCVSS 7.5WeaponizedEPSS 94%

    apache · http serverSep 18, 2017

  • CVE-2017-12615
    92Now

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · tomcatSep 19, 2017

  • CVE-2014-9611
    43Plan

    Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmi

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    netsweeper · netsweeperSep 19, 2017

  • CVE-2014-9618
    61This week

    The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass aut

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    netsweeper · netsweeperSep 19, 2017

  • CVE-2017-14143
    62This week

    The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote at

    CriticalCVSS 9.8WeaponizedEPSS 77%

    kaltura · kaltura serverSep 19, 2017

  • CVE-2017-10784
    40Plan

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers t

    HighCVSS 8.8No exploitEPSS 16%

    ruby-lang · rubySep 19, 2017

  • CVE-2017-6315
    44Plan

    Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    sophos · astaro security gateway firmwareSep 19, 2017

  • CVE-2017-12616
    51Plan

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code

    HighCVSS 7.5No exploitEPSS 70%

    apache · tomcatSep 19, 2017

  • CVE-2014-8684
    61This week

    CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and

    CriticalCVSS 9.8WeaponizedEPSS 71%

    codeigniter · codeigniterSep 19, 2017

  • CVE-2014-8686
    60This week

    CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption sch

    CriticalCVSS 9.8WeaponizedEPSS 37%

    codeigniter · codeigniterSep 19, 2017

  • CVE-2017-8770
    33Monitor

    There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device vi

    HighCVSS 7.5Proof of conceptEPSS 10%

    twsz · wifi repeater firmwareSep 20, 2017

  • CVE-2015-4074
    47Plan

    Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a

    HighCVSS 7.5Proof of conceptEPSS 56%

    helpdesk pro project · helpdesk proSep 20, 2017

  • CVE-2017-7924
    60This week

    An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB,

    HighCVSS 7.5WeaponizedEPSS 22%

    rockwellautomation · 1763-l16bwa firmwareSep 20, 2017

  • CVE-2017-12611
    65This week

    In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string lite

    CriticalCVSS 9.8Proof of conceptEPSS 87%

    apache · strutsSep 20, 2017

  • CVE-2015-2826
    25Monitor

    WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.

    MediumCVSS 5.3Proof of conceptEPSS 12%

    simple ads manager project · simple ads managerSep 20, 2017

  • CVE-2015-1187
    94Now

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.c

    CriticalCVSS 9.8KEVWeaponizedEPSS 82%

    trendnet · tew-731br firmwareSep 21, 2017

  • CVE-2017-12929
    38Monitor

    Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary

    HighCVSS 8.8Proof of conceptEPSS 10%

    tecnovision · dlx spot player4Sep 21, 2017

  • CVE-2017-11395
    39Monitor

    Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers wi

    HighCVSS 8.8No exploitEPSS 14%

    trendmicro · smart protection serverSep 22, 2017

  • CVE-2017-14078
    54Plan

    SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbi

    CriticalCVSS 9.8No exploitEPSS 50%

    trendmicro · mobile securitySep 22, 2017

  • CVE-2017-14079
    38Monitor

    Unrestricted file uploads in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrar

    HighCVSS 8.8No exploitEPSS 10%

    trendmicro · mobile securitySep 22, 2017

  • CVE-2017-14081
    40Plan

    Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to ex

    HighCVSS 8.8No exploitEPSS 16%

    trendmicro · mobile securitySep 22, 2017

  • CVE-2017-14706
    60This week

    DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /w

    CriticalCVSS 9.8WeaponizedEPSS 28%

    denyall · i-suiteSep 22, 2017

  • CVE-2017-14627
    40Plan

    Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INF

    HighCVSS 7.8WeaponizedEPSS 19%

    cyberlink · labelprintSep 23, 2017

  • CVE-2017-14719
    34Monitor

    Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen

    HighCVSS 7.5Proof of conceptEPSS 12%

    wordpress · wordpressSep 23, 2017

  • CVE-2015-4667
    42Plan

    Multiple hardcoded credentials in Xsuite 2.x.

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    xceedium · xsuiteSep 25, 2017

  • CVE-2015-8249
    61This week

    The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary fil

    CriticalCVSS 9.8WeaponizedEPSS 73%

    manageengine · desktop centralSep 27, 2017

  • CVE-2017-14849
    46Plan

    Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the p

    HighCVSS 7.5Proof of conceptEPSS 54%

    nodejs · node.jsSep 27, 2017

  • CVE-2017-12231
    62This week

    A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unaut

    HighCVSS 7.5KEVWeaponizedEPSS 7%

    cisco · iosSep 28, 2017

  • CVE-2017-12232
    57Plan

    A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.

    MediumCVSS 6.5KEVWeaponizedEPSS 2%

    cisco · iosSep 28, 2017

  • CVE-2017-12233
    62This week

    Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an

    HighCVSS 7.5KEVWeaponizedEPSS 7%

    cisco · iosSep 28, 2017

  • CVE-2017-12234
    62This week

    Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an

    HighCVSS 7.5KEVWeaponizedEPSS 7%

    cisco · iosSep 28, 2017

  • CVE-2017-12235
    62This week

    A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could al

    HighCVSS 7.5KEVWeaponizedEPSS 7%

    cisco · iosSep 28, 2017

  • CVE-2017-12237
    62This week

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could

    HighCVSS 7.5KEVWeaponizedEPSS 7%

    cisco · iosSep 28, 2017

  • CVE-2017-12238
    57Plan

    A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could

    MediumCVSS 6.5KEVWeaponizedEPSS 2%

    cisco · iosSep 28, 2017

  • CVE-2017-12240
    73This week

    The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticat

    CriticalCVSS 9.8KEVWeaponizedEPSS 13%

    cisco · iosSep 28, 2017

  • CVE-2017-14867
    46Plan

    Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to su

    HighCVSS 8.8No exploitEPSS 36%

    git-scm · gitSep 28, 2017

  • CVE-2017-14942
    57Plan

    Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct reques

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    intelbras · wrn 150 firmwareSep 29, 2017