Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2017

84 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2017-14955
    27Monitor

    Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote att

    MediumCVSS 5.9Proof of conceptEPSS 12%

    checkmk · checkmkOct 1, 2017

  • CVE-2017-13704
    50Plan

    In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value.

    HighCVSS 7.5No exploitEPSS 65%

    canonical · ubuntu linuxOct 2, 2017

  • CVE-2017-14492
    67This week

    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via

    CriticalCVSS 9.8Proof of conceptEPSS 94%

    canonical · ubuntu linuxOct 2, 2017

  • CVE-2017-14493
    65This week

    Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code vi

    CriticalCVSS 9.8Proof of conceptEPSS 85%

    canonical · ubuntu linuxOct 2, 2017

  • CVE-2017-14494
    44Plan

    dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handli

    MediumCVSS 5.9Proof of conceptEPSS 70%

    canonical · ubuntu linuxOct 2, 2017

  • CVE-2017-14495
    56Plan

    Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a

    HighCVSS 7.5Proof of conceptEPSS 85%

    canonical · ubuntu linuxOct 2, 2017

  • CVE-2017-14496
    51Plan

    Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is speci

    HighCVSS 7.5Proof of conceptEPSS 69%

    canonical · ubuntu linuxOct 2, 2017

  • CVE-2017-6090
    64This week

    Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute

    HighCVSS 8.8WeaponizedEPSS 96%

    phpcollab · phpcollabOct 2, 2017

  • CVE-2017-12617
    92Now

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · tomcatOct 3, 2017

  • CVE-2017-14491
    65This week

    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via

    CriticalCVSS 9.8Proof of conceptEPSS 86%

    thekelleys · dnsmasqOct 3, 2017

  • CVE-2017-12149
    96Now

    In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOn

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    redhat · jboss enterprise application platformOct 4, 2017

  • CVE-2017-1000112
    40Plan

    Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch.

    HighCVSS 7.0WeaponizedEPSS 20%

    linux · linux kernelOct 4, 2017

  • CVE-2017-1000117
    60This week

    A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any prog

    HighCVSS 8.8WeaponizedEPSS 77%

    git-scm · gitOct 4, 2017

  • CVE-2017-1000119
    46Plan

    October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other a

    HighCVSS 7.2WeaponizedEPSS 61%

    octobercms · octoberOct 4, 2017

  • CVE-2017-1000253
    64This week

    Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86

    HighCVSS 7.8KEVWeaponizedEPSS 10%

    linux · linux kernelOct 4, 2017

  • CVE-2017-12263
    33Monitor

    A vulnerability in the web interface of Cisco License Manager software could allow an unauthenticated, remote attacker to download and view

    HighCVSS 7.5No exploitEPSS 11%

    cisco · license managerOct 5, 2017

  • CVE-2017-14084
    35Monitor

    A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary cod

    HighCVSS 8.1Proof of conceptEPSS 10%

    trendmicro · officescanOct 5, 2017

  • CVE-2015-2673
    41Plan

    The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 th

    HighCVSS 8.8WeaponizedEPSS 18%

    wpeasycart · wp easycartOct 6, 2017

  • CVE-2014-0030
    44Plan

    The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vec

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    apache · rollerOct 9, 2017

  • CVE-2017-14980
    60This week

    Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login

    CriticalCVSS 9.8WeaponizedEPSS 22%

    flexense · syncbreezeOct 9, 2017

  • CVE-2017-5637
    52Plan

    Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, w

    HighCVSS 7.5Proof of conceptEPSS 73%

    apache · zookeeperOct 9, 2017

  • CVE-2015-2856
    60This week

    Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210

    HighCVSS 7.5WeaponizedEPSS 56%

    accellion · file transfer applianceOct 10, 2017

  • CVE-2013-6924
    44Plan

    Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    seagate · blackarmor nas 220 firmwareOct 11, 2017

  • CVE-2017-0903
    44Plan

    RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.

    CriticalCVSS 9.8No exploitEPSS 15%

    rubygems · rubygemsOct 11, 2017

  • CVE-2017-5789
    44Plan

    HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via uns

    CriticalCVSS 9.8No exploitEPSS 17%

    hp · loadrunnerOct 11, 2017

  • CVE-2017-5791
    60This week

    The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authenticati

    CriticalCVSS 9.8No exploitEPSS 68%

    hp · intelligent management center platOct 11, 2017

  • CVE-2017-15277
    32Monitor

    ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file th

    MediumCVSS 6.5Proof of conceptEPSS 19%

    graphicsmagick · graphicsmagickOct 12, 2017

  • CVE-2017-11762
    40Plan

    The Microsoft Graphics Component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R

    HighCVSS 8.8No exploitEPSS 17%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11763
    40Plan

    The Microsoft Graphics Component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R

    HighCVSS 8.8No exploitEPSS 17%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11769
    37Monitor

    The Microsoft Windows TRIE component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execut

    HighCVSS 7.8No exploitEPSS 19%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11771
    55Plan

    The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold

    CriticalCVSS 9.8No exploitEPSS 51%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11774
    79This week

    Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Micros

    HighCVSS 7.8KEVWeaponizedEPSS 59%

    microsoft · outlookOct 13, 2017

  • CVE-2017-11779
    42Plan

    The Microsoft Windows Domain Name System (DNS) DNSAPI.dll on Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold,

    HighCVSS 8.1No exploitEPSS 33%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11781
    34Monitor

    The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Go

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11793
    45Plan

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    HighCVSS 7.5Proof of conceptEPSS 49%

    microsoft · internet explorerOct 13, 2017

  • CVE-2017-11799
    49Plan

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrar

    HighCVSS 7.5Proof of conceptEPSS 63%

    microsoft · chakracoreOct 13, 2017

  • CVE-2017-11802
    51Plan

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrar

    HighCVSS 7.5Proof of conceptEPSS 69%

    microsoft · chakracoreOct 13, 2017

  • CVE-2017-11809
    50Plan

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrar

    HighCVSS 7.5Proof of conceptEPSS 68%

    microsoft · chakracoreOct 13, 2017

  • CVE-2017-11810
    46Plan

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    HighCVSS 7.5Proof of conceptEPSS 54%

    microsoft · internet explorerOct 13, 2017

  • CVE-2017-11811
    50Plan

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrar

    HighCVSS 7.5Proof of conceptEPSS 65%

    microsoft · edgeOct 13, 2017

  • CVE-2017-11812
    44Plan

    ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code

    HighCVSS 7.5No exploitEPSS 47%

    microsoft · chakracoreOct 13, 2017

  • CVE-2017-11815
    25Monitor

    The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Go

    MediumCVSS 5.3No exploitEPSS 13%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11816
    28Monitor

    The Microsoft Windows Graphics Device Interface (GDI) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S

    MediumCVSS 5.5No exploitEPSS 19%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-11819
    34Monitor

    Microsoft Windows 7 SP1 allows an attacker to execute arbitrary code in the context of the current user, due to how Microsoft browsers handl

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · windows 7Oct 13, 2017

  • CVE-2017-11825
    38Monitor

    Microsoft Office 2016 Click-to-Run (C2R) and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform acti

    HighCVSS 7.8No exploitEPSS 22%

    microsoft · officeOct 13, 2017

  • CVE-2017-11826
    85Now

    Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Wo

    HighCVSS 7.8KEVWeaponizedEPSS 81%

    microsoft · office compatibility packOct 13, 2017

  • CVE-2017-8717
    38Monitor

    The Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2,

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-8718
    38Monitor

    The Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2,

    HighCVSS 7.8No exploitEPSS 23%

    microsoft · windows 10Oct 13, 2017

  • CVE-2017-12629
    67This week

    Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config A

    CriticalCVSS 9.8Proof of conceptEPSS 91%

    apache · solrOct 14, 2017

  • CVE-2017-15363
    35Monitor

    Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler exten

    HighCVSS 7.5Proof of conceptEPSS 15%

    luracast · restlerOct 15, 2017

  • CVE-2014-9147
    33Monitor

    Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.

    HighCVSS 7.5Proof of conceptEPSS 11%

    fiyo · fiyo cmsOct 16, 2017

  • CVE-2014-9148
    42Plan

    Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    fiyo · fiyo cmsOct 16, 2017

  • CVE-2015-2780
    44Plan

    Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    berta · berta cmsOct 16, 2017

  • CVE-2014-9118
    51Plan

    The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metac

    HighCVSS 8.8Proof of conceptEPSS 53%

    dasanzhone · znid 2426a firmwareOct 17, 2017

  • CVE-2017-14322
    50Plan

    The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remo

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    interspire · email marketerOct 18, 2017

  • CVE-2017-12285
    32Monitor

    A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arb

    MediumCVSS 5.3No exploitEPSS 37%

    cisco · prime network analysis moduleOct 19, 2017

  • CVE-2017-10271
    90Now

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security).

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    oracle · weblogic serverOct 19, 2017

  • CVE-2017-10355
    26Monitor

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).

    MediumCVSS 5.3Proof of conceptEPSS 16%

    oracle · jdkOct 19, 2017

  • CVE-2017-10366
    52Plan

    Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor).

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    oracle · peoplesoft enterprise peopletoolsOct 19, 2017

  • CVE-2015-6668
    33Monitor

    The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload dir

    HighCVSS 7.5Proof of conceptEPSS 10%

    wp-jobmanager · job managerOct 19, 2017

  • CVE-2017-15647
    38Monitor

    On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.

    HighCVSS 7.5Proof of conceptEPSS 26%

    fiberhome · routerfiberhome firmwareOct 19, 2017

  • CVE-2017-14937
    40Plan

    The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (

    MediumCVSS 4.7WeaponizedEPSS 0%

    pcu · pcuOct 20, 2017

  • CVE-2017-11292
    69This week

    Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be us

    HighCVSS 8.8KEVWeaponizedEPSS 11%

    adobe · flash player desktop runtimeOct 22, 2017

  • CVE-2017-7117
    38Monitor

    An issue was discovered in certain Apple products.

    HighCVSS 8.8Proof of conceptEPSS 10%

    apple · safariOct 22, 2017

  • CVE-2017-14328
    30Monitor

    Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.

    HighCVSS 7.5No exploitEPSS 1%

    extremenetworks · extremexosOct 23, 2017

  • CVE-2017-15580
    44Plan

    osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats.

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    osticket · osticketOct 23, 2017

  • CVE-2017-9946
    37Monitor

    A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5.

    HighCVSS 7.5No exploitEPSS 24%

    siemens · apogee pxc firmwareOct 23, 2017

  • CVE-2014-3744
    40Plan

    Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (en

    HighCVSS 7.5Proof of conceptEPSS 34%

    nodejs · node.jsOct 23, 2017

  • CVE-2017-13772
    50Plan

    Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arb

    HighCVSS 8.8Proof of conceptEPSS 51%

    tp-link · wr940n firmwareOct 23, 2017

  • CVE-2014-1203
    44Plan

    The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacha

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    eyou · eyouOct 24, 2017

  • CVE-2017-15222
    60This week

    Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.

    CriticalCVSS 9.8WeaponizedEPSS 60%

    nftp project · nftpOct 24, 2017

  • CVE-2017-15908
    37Monitor

    In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in th

    HighCVSS 7.5No exploitEPSS 23%

    systemd project · systemdOct 26, 2017

  • CVE-2017-5070
    75This week

    Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote atta

    HighCVSS 8.8KEVWeaponizedEPSS 32%

    google · chromeOct 27, 2017

  • CVE-2017-5098
    40Plan

    A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an o

    HighCVSS 8.8No exploitEPSS 15%

    google · chromeOct 27, 2017

  • CVE-2017-5115
    43Plan

    Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption v

    HighCVSS 8.8No exploitEPSS 26%

    google · chromeOct 27, 2017

  • CVE-2017-5116
    39Monitor

    Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote atta

    HighCVSS 8.8No exploitEPSS 12%

    google · chromeOct 27, 2017

  • CVE-2016-5003
    43Plan

    The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted

    CriticalCVSS 9.8No exploitEPSS 14%

    apache · ws-xmlrpcOct 27, 2017

  • CVE-2017-13089
    59Plan

    GNU Wget: stack overflow in HTTP protocol handling

    HighCVSS 8.8Proof of conceptEPSS 79%

    gnu · wgetOct 27, 2017

  • CVE-2017-13090
    46Plan

    GNU Wget: heap overflow in HTTP protocol handling

    HighCVSS 8.8No exploitEPSS 36%

    gnu · wgetOct 27, 2017

  • CVE-2017-16227
    36Monitor

    The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via

    HighCVSS 7.5No exploitEPSS 18%

    quagga · quaggaOct 29, 2017

  • CVE-2012-5357
    60This week

    Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remot

    CriticalCVSS 9.8WeaponizedEPSS 67%

    ektron · ektron content management systemOct 30, 2017

  • CVE-2015-0224
    35Monitor

    qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence se

    HighCVSS 7.5No exploitEPSS 15%

    apache · qpidOct 30, 2017

  • CVE-2017-7411
    55Plan

    An issue was discovered in Enalean Tuleap 9.6 and prior versions.

    HighCVSS 8.8WeaponizedEPSS 66%

    enalean · tuleapOct 30, 2017

  • CVE-2012-0881
    35Monitor

    Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an

    HighCVSS 7.5No exploitEPSS 17%

    apache · xerces2 javaOct 30, 2017