By publication date

Exploited and new serious CVEs: January 2018

114 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
66This week	CVE-2018-3810Proof of concept	Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackeroturia · smart google code inserter · CWE-287 Pre-auth Auth bypass	Critical9.8	—	91.3%	Jan 1, 2018
52Plan	CVE-2018-3811Proof of concept	SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to exeoturia · smart google code inserter · CWE-89 Pre-auth SQL injection	Critical9.8	—	42.0%	Jan 1, 2018
55Plan	CVE-2017-18017No exploit	The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attaclinux · linux kernel · CWE-416 Pre-auth Memory safety	Critical9.8	—	52.8%	Jan 3, 2018
60This week	CVE-2017-1000479Weaponized	pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrarnetgate · pfsense · CWE-352 pre-auth RCE CSRF	High8.8	—	31.7%	Jan 3, 2018
97Now	CVE-2017-1000486Weaponized	Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code executionprimetek · primefaces · CWE-326 pre-auth RCE Weak crypto	Critical9.8	KEV	94.1%	Jan 3, 2018
61This week	CVE-2017-8046Proof of concept	Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1vmware · spring boot · CWE-20 Pre-auth	Critical9.8	—	74.5%	Jan 4, 2018
43Plan	CVE-2018-0114Proof of concept	A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens ucisco · node-jose · CWE-347 Pre-auth Weak crypto	High7.5	—	42.6%	Jan 4, 2018
44Plan	CVE-2017-5715Proof of concept	Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of informationintel · atom c · CWE-203	Medium5.6	—	74.0%	Jan 4, 2018
50Plan	CVE-2017-5753Proof of concept	Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an atintel · atom c · CWE-203	Medium5.6	—	93.8%	Jan 4, 2018
47Plan	CVE-2017-5754Proof of concept	Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of informationintel · atom c · CWE-200 Info leak	Medium5.6	—	84.1%	Jan 4, 2018
33Monitor	CVE-2018-0744Proof of concept	The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 anmicrosoft · windows 10 Local privilege escalation	High7.0	—	15.0%	Jan 4, 2018
54Plan	CVE-2018-0758Proof of concept	Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the contemicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	80.7%	Jan 4, 2018
34Monitor	CVE-2018-0762No exploit	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, anmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	11.9%	Jan 4, 2018
41Plan	CVE-2018-0767Proof of concept	Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further cmicrosoft · chakracore · CWE-125 Pre-auth Memory safety	Medium5.3	—	65.4%	Jan 4, 2018
54Plan	CVE-2018-0769Proof of concept	Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the contemicrosoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	78.9%	Jan 4, 2018
54Plan	CVE-2018-0770Proof of concept	Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the contemicrosoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	78.4%	Jan 4, 2018
34Monitor	CVE-2018-0772No exploit	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, anmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	11.9%	Jan 4, 2018
50Plan	CVE-2018-0774Proof of concept	Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting microsoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	67.8%	Jan 4, 2018
50Plan	CVE-2018-0775Proof of concept	Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting microsoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	67.8%	Jan 4, 2018
54Plan	CVE-2018-0776Proof of concept	Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the contemicrosoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	78.4%	Jan 4, 2018
54Plan	CVE-2018-0777Proof of concept	Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the contemicrosoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	78.4%	Jan 4, 2018
39Monitor	CVE-2018-0780Proof of concept	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to furmicrosoft · edge · CWE-125 Pre-auth Memory safety	Medium5.3	—	58.5%	Jan 4, 2018
33Monitor	CVE-2018-0781No exploit	Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the contemicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	11.1%	Jan 4, 2018
63This week	CVE-2014-7862Weaponized	The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create adzohocorp · desktop central · CWE-264 Pre-auth	Critical9.8	—	81.0%	Jan 4, 2018
38Monitor	CVE-2017-17867Proof of concept	Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger fieldintenogroup · iopsys · CWE-732 RCE	High8.8	—	11.0%	Jan 4, 2018
54Plan	CVE-2017-16720Proof of concept	A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier.advantech · webaccess · CWE-22 Pre-auth Path traversal	Critical9.8	—	50.3%	Jan 5, 2018
59Plan	CVE-2017-16666Weaponized	Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAPxplico · xplico · CWE-78 RCE Auth bypass Command injection	High8.8	—	80.7%	Jan 5, 2018
29Monitor	CVE-2014-7221Proof of concept	TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) bteamspeak · teamspeak3 · CWE-119 Memory safety Denial of service	Medium6.5	—	10.9%	Jan 8, 2018
29Monitor	CVE-2014-7222Proof of concept	Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) byteamspeak · teamspeak3 · CWE-20 Denial of service	Medium6.5	—	10.9%	Jan 8, 2018
45Plan	CVE-2017-7997Proof of concept	Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prngespage · gespage · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	19.3%	Jan 8, 2018
37Monitor	CVE-2018-0791No exploit	Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerabilimicrosoft · office RCE	High7.8	—	20.5%	Jan 9, 2018
44Plan	CVE-2018-0792No exploit	Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka microsoft · office · CWE-787 pre-auth RCE Memory safety	High8.8	—	28.3%	Jan 9, 2018
37Monitor	CVE-2018-0793No exploit	Microsoft Outlook 2007, Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email mmicrosoft · office RCE	High7.8	—	20.5%	Jan 9, 2018
41Plan	CVE-2018-0794No exploit	Microsoft Word in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code executmicrosoft · office pre-auth RCE	High8.8	—	20.0%	Jan 9, 2018
41Plan	CVE-2018-0795No exploit	Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects amicrosoft · office pre-auth RCE	High8.8	—	19.2%	Jan 9, 2018
42Plan	CVE-2018-0796No exploit	Microsoft Excel in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execumicrosoft · excel pre-auth RCE	High8.8	—	23.2%	Jan 9, 2018
38Monitor	CVE-2018-0797No exploit	Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF contemicrosoft · office · CWE-787 RCE Memory safety	High7.8	—	24.6%	Jan 9, 2018
94Now	CVE-2018-0798Weaponized	Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execumicrosoft · office · CWE-787 pre-auth RCE Memory safety	High8.8	KEV	95.1%	Jan 9, 2018
42Plan	CVE-2018-0801No exploit	Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execumicrosoft · office pre-auth RCE	High8.8	—	24.3%	Jan 9, 2018
89Now	CVE-2018-0802Weaponized	Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code executmicrosoft · office · CWE-787 RCE Memory safety	High7.8	KEV	93.2%	Jan 9, 2018
42Plan	CVE-2018-0804No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office pre-auth RCE	High8.8	—	24.3%	Jan 9, 2018
42Plan	CVE-2018-0805No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office pre-auth RCE	High8.8	—	24.3%	Jan 9, 2018
42Plan	CVE-2018-0806No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office pre-auth RCE	High8.8	—	24.4%	Jan 9, 2018
42Plan	CVE-2018-0807No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office pre-auth RCE	High8.8	—	24.3%	Jan 9, 2018
38Monitor	CVE-2018-0812No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office · CWE-787 RCE Memory safety	High7.8	—	24.6%	Jan 9, 2018
40Plan	CVE-2016-9722Weaponized	IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by uibm · qradar security information and event manager · CWE-284 Broken access control (IDOR)	Medium4.2	—	12.0%	Jan 10, 2018
34Monitor	CVE-2017-15663Proof of concept	In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability.flexense · disk pulse · CWE-358 Pre-auth Denial of service	High7.5	—	13.1%	Jan 10, 2018
54Plan	CVE-2017-17485Proof of concept	FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix fasterxml · jackson-databind · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	49.7%	Jan 10, 2018
40Plan	CVE-2018-5333Weaponized	In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid linux · linux kernel · CWE-476 Memory safety Denial of service	Medium5.5	—	7.2%	Jan 11, 2018
55Plan	CVE-2018-5347Proof of concept	Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.pseagate · personal cloud firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	54.1%	Jan 11, 2018
48Plan	CVE-2018-5371No exploit	diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticatd-link · dsl-2540u firmware · CWE-78 RCE Command injection	High8.8	—	41.9%	Jan 12, 2018
34Monitor	CVE-2014-6435Proof of concept	cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication, which allows remoteaztech · adsl dsl5018en \(1t1r\) firmware · CWE-287 Pre-auth Auth bypass Denial of service	High7.5	—	12.5%	Jan 12, 2018
52Plan	CVE-2014-6436Proof of concept	Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authenticatiaztech · adsl dsl5018en \(1t1r\) firmware · CWE-287 pre-auth RCE Auth bypass	Critical9.8	—	42.1%	Jan 12, 2018
44Plan	CVE-2014-6437Proof of concept	Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via aztech · adsl dsl5018en \(1t1r\) firmware · CWE-200 Pre-auth Info leak	Critical9.8	—	15.5%	Jan 12, 2018
49Plan	CVE-2017-16885Proof of concept	Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usfiberhome · lm53q1 firmware · CWE-732 Pre-auth	Critical9.8	—	33.4%	Jan 12, 2018
50Plan	CVE-2017-16887Proof of concept	The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal.fiberhome · lm53q1 firmware · CWE-275 Pre-auth	Critical9.8	—	36.6%	Jan 12, 2018
51Plan	CVE-2018-5262Proof of concept	A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in tflexense · diskboss · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	39.1%	Jan 12, 2018
39Monitor	CVE-2018-5702Proof of concept	Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows rtransmissionbt · transmission pre-auth RCE	High8.8	—	11.9%	Jan 15, 2018
26Monitor	CVE-2018-5711Proof of concept	gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x beforephp · php · CWE-681 Denial of service	Medium5.5	—	13.2%	Jan 16, 2018
48Plan	CVE-2018-5712No exploit	An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1.php · php · CWE-79 Pre-auth XSS	Medium6.1	—	79.9%	Jan 16, 2018
42Plan	CVE-2018-5724Proof of concept	MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore.cgi.barni · master ip camera01 firmware · CWE-434 Pre-auth File upload	Critical9.8	—	11.5%	Jan 16, 2018
45Plan	CVE-2018-5726Proof of concept	MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request, as demonstrated by tbarni · master ip camera01 firmware · CWE-200 Pre-auth Info leak	Critical9.8	—	19.8%	Jan 16, 2018
43Plan	CVE-2018-2616No exploit	Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Diagnostic Assistant).oracle · oss support tools	High8.8	—	27.0%	Jan 17, 2018
37Monitor	CVE-2018-2636Proof of concept	Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security).oracle · hospitality simphony Pre-auth	High8.1	—	15.1%	Jan 17, 2018
44Plan	CVE-2016-6814No exploit	When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standarapache · groovy · CWE-502 Pre-auth Deserialization	Critical9.8	—	17.2%	Jan 18, 2018
33Monitor	CVE-2015-9251Proof of concept	jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType ojquery · jquery · CWE-79 Pre-auth XSS	Medium6.1	—	29.7%	Jan 18, 2018
60This week	CVE-2017-18044Weaponized	A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6.commvault · commvault · CWE-78 pre-auth RCE Command injection	Critical9.8	—	69.7%	Jan 19, 2018
45Plan	CVE-2017-14094Proof of concept	A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote commandtrendmicro · smart protection server · CWE-78 pre-auth RCE Command injection	Critical9.8	—	19.3%	Jan 19, 2018
36Monitor	CVE-2017-14095Proof of concept	A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote commandtrendmicro · smart protection server · CWE-98 pre-auth RCE	High8.1	—	12.4%	Jan 19, 2018
43Plan	CVE-2017-14097Proof of concept	An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker trendmicro · smart protection server Pre-auth	Critical9.8	—	12.7%	Jan 19, 2018
49Plan	CVE-2017-14803No exploit	In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connenetiq · access manager pre-auth RCE	Critical9.8	—	34.5%	Jan 19, 2018
35Monitor	CVE-2016-10708Proof of concept	sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-seopenbsd · openssh · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	15.7%	Jan 21, 2018
63This week	CVE-2018-5955Weaponized	An issue was discovered in GitStack through 2.3.10.smartmobilesoftware · gitstack · CWE-20 Pre-auth	Critical9.8	—	81.4%	Jan 21, 2018
45Plan	CVE-2016-10709Weaponized	pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '\|' character in the status_rrd_graph_img.php grpfsense · pfsense · CWE-78 RCE Command injection	High8.8	—	33.7%	Jan 22, 2018
60This week	CVE-2017-18047Weaponized	Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply.labf · nfsaxe · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	19.7%	Jan 22, 2018
31Monitor	CVE-2018-1042Proof of concept	Moodle 3.x has Server Side Request Forgery in the filepicker.moodle · moodle · CWE-918 SSRF	Medium6.5	—	16.2%	Jan 22, 2018
65This week	CVE-2018-5999Weaponized	An issue was discovered in AsusWRT before 3.0.0.4.384_10007.asus · asuswrt Pre-auth	Critical9.8	—	87.5%	Jan 22, 2018
65This week	CVE-2018-6000Weaponized	An issue was discovered in AsusWRT before 3.0.0.4.384_10007.asus · asuswrt · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	85.1%	Jan 22, 2018
37Monitor	CVE-2018-0845No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office RCE	High7.8	—	19.7%	Jan 22, 2018
41Plan	CVE-2018-0848No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office pre-auth RCE	High8.8	—	20.4%	Jan 22, 2018
41Plan	CVE-2018-0849No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office pre-auth RCE	High8.8	—	18.6%	Jan 22, 2018
41Plan	CVE-2018-0862No exploit	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allmicrosoft · office pre-auth RCE	High8.8	—	18.6%	Jan 22, 2018
56Plan	CVE-2017-16597No exploit	This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7netgain-systems · enterprise manager · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	57.2%	Jan 22, 2018
51Plan	CVE-2017-16603No exploit	This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterpnetgain-systems · enterprise manager · CWE-22 Path traversal	High8.8	—	54.0%	Jan 22, 2018
54Plan	CVE-2017-18048Weaponized	Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lmonstra · monstra · CWE-434 RCE File upload	High8.8	—	63.3%	Jan 23, 2018
64This week	CVE-2017-2741Weaponized	A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D.hp · j9v82a firmware pre-auth RCE	Critical9.8	—	84.6%	Jan 23, 2018
35Monitor	CVE-2018-5359Proof of concept	The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access becausflexense · sysgauge · CWE-119 Pre-auth Memory safety	High8.1	—	8.9%	Jan 23, 2018
45Plan	CVE-2018-5972Proof of concept	SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listing URI.quickad project · quickad · CWE-89 Pre-auth SQL injection	Critical9.8	—	19.1%	Jan 24, 2018
45Plan	CVE-2018-5979Proof of concept	SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.wchat project · wchat · CWE-89 Pre-auth SQL injection	Critical9.8	—	19.1%	Jan 24, 2018
45Plan	CVE-2018-5985Proof of concept	SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.livecrm · livecrm saas cloud · CWE-89 Pre-auth SQL injection	Critical9.8	—	19.1%	Jan 24, 2018
45Plan	CVE-2018-5988Proof of concept	SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.flexible poll project · flexible poll · CWE-89 Pre-auth SQL injection	Critical9.8	—	19.1%	Jan 24, 2018
63This week	CVE-2017-13696Weaponized	A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Eflexense · dupscout · CWE-119 Pre-auth Memory safety	Critical9.8	—	78.6%	Jan 24, 2018
34Monitor	CVE-2018-5319Proof of concept	RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.ravpower · filehub firmware · CWE-200 Pre-auth Info leak	High7.5	—	12.3%	Jan 24, 2018
60This week	CVE-2018-1000006Weaponized	GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, speciatom · electron · CWE-78 pre-auth RCE Command injection	High8.8	—	84.3%	Jan 24, 2018
21Monitor	CVE-2018-5967No exploit	Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.netis-systems · wf2419 firmware · CWE-79 XSS	Medium5.4	—	0.6%	Jan 25, 2018
45Plan	CVE-2018-5973Proof of concept	SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.phpeihitech · professional local directory script · CWE-89 Pre-auth SQL injection	Critical9.8	—	20.0%	Jan 25, 2018
46Plan	CVE-2018-5997Proof of concept	An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056.ravpower · filehub firmware · CWE-22 pre-auth RCE Path traversal File upload	Critical9.8	—	23.5%	Jan 25, 2018
42Plan	CVE-2017-12377No exploit	ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a clamav · clamav · CWE-125 pre-auth RCE Memory safety	Critical9.8	—	11.5%	Jan 26, 2018
43Plan	CVE-2017-12379No exploit	ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a clamav · clamav · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	12.5%	Jan 26, 2018
43Plan	CVE-2017-17976Proof of concept	In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.perfexcrm · perfex crm · CWE-434 pre-auth RCE File upload	Critical9.8	—	12.5%	Jan 26, 2018

CVE-2018-3810
66This week
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attacker
CriticalCVSS 9.8Proof of conceptEPSS 91%
- Pre-auth
- Auth bypass
oturia · smart google code inserterJan 1, 2018
CVE-2018-3811
52Plan
SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to exe
CriticalCVSS 9.8Proof of conceptEPSS 42%
- Pre-auth
- SQL injection
oturia · smart google code inserterJan 1, 2018
CVE-2017-18017
55Plan
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attac
CriticalCVSS 9.8No exploitEPSS 52%
- Pre-auth
- Memory safety
linux · linux kernelJan 3, 2018
CVE-2017-1000479
60This week
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrar
HighCVSS 8.8WeaponizedEPSS 31%
- pre-auth RCE
- CSRF
netgate · pfsenseJan 3, 2018
CVE-2017-1000486
97Now
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
CriticalCVSS 9.8KEVWeaponizedEPSS 94%
- pre-auth RCE
- Weak crypto
primetek · primefacesJan 3, 2018
CVE-2017-8046
61This week
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1
CriticalCVSS 9.8Proof of conceptEPSS 74%
- Pre-auth
vmware · spring bootJan 4, 2018
CVE-2018-0114
43Plan
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens u
HighCVSS 7.5Proof of conceptEPSS 42%
- Pre-auth
- Weak crypto
cisco · node-joseJan 4, 2018
CVE-2017-5715
44Plan
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information
MediumCVSS 5.6Proof of conceptEPSS 74%
intel · atom cJan 4, 2018
CVE-2017-5753
50Plan
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at
MediumCVSS 5.6Proof of conceptEPSS 93%
intel · atom cJan 4, 2018
CVE-2017-5754
47Plan
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information
MediumCVSS 5.6Proof of conceptEPSS 84%
- Info leak
intel · atom cJan 4, 2018
CVE-2018-0744
33Monitor
The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 an
HighCVSS 7.0Proof of conceptEPSS 15%
- Local privilege escalation
microsoft · windows 10Jan 4, 2018
CVE-2018-0758
54Plan
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte
HighCVSS 7.5Proof of conceptEPSS 80%
- pre-auth RCE
- Memory safety
microsoft · chakracoreJan 4, 2018
CVE-2018-0762
34Monitor
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, an
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
microsoft · chakracoreJan 4, 2018
CVE-2018-0767
41Plan
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further c
MediumCVSS 5.3Proof of conceptEPSS 65%
- Pre-auth
- Memory safety
microsoft · chakracoreJan 4, 2018
CVE-2018-0769
54Plan
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte
HighCVSS 7.5Proof of conceptEPSS 78%
- pre-auth RCE
- Memory safety
microsoft · edgeJan 4, 2018
CVE-2018-0770
54Plan
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte
HighCVSS 7.5Proof of conceptEPSS 78%
- pre-auth RCE
- Memory safety
microsoft · edgeJan 4, 2018
CVE-2018-0772
34Monitor
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, an
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
microsoft · chakracoreJan 4, 2018
CVE-2018-0774
50Plan
Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting
HighCVSS 7.5Proof of conceptEPSS 67%
- pre-auth RCE
- Memory safety
microsoft · edgeJan 4, 2018
CVE-2018-0775
50Plan
Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting
HighCVSS 7.5Proof of conceptEPSS 67%
- pre-auth RCE
- Memory safety
microsoft · edgeJan 4, 2018
CVE-2018-0776
54Plan
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte
HighCVSS 7.5Proof of conceptEPSS 78%
- pre-auth RCE
- Memory safety
microsoft · edgeJan 4, 2018
CVE-2018-0777
54Plan
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte
HighCVSS 7.5Proof of conceptEPSS 78%
- pre-auth RCE
- Memory safety
microsoft · edgeJan 4, 2018
CVE-2018-0780
39Monitor
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to fur
MediumCVSS 5.3Proof of conceptEPSS 58%
- Pre-auth
- Memory safety
microsoft · edgeJan 4, 2018
CVE-2018-0781
33Monitor
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
microsoft · chakracoreJan 4, 2018
CVE-2014-7862
63This week
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create ad
CriticalCVSS 9.8WeaponizedEPSS 81%
- Pre-auth
zohocorp · desktop centralJan 4, 2018
CVE-2017-17867
38Monitor
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field
HighCVSS 8.8Proof of conceptEPSS 11%
- RCE
intenogroup · iopsysJan 4, 2018
CVE-2017-16720
54Plan
A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier.
CriticalCVSS 9.8Proof of conceptEPSS 50%
- Pre-auth
- Path traversal
advantech · webaccessJan 5, 2018
CVE-2017-16666
59Plan
Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP
HighCVSS 8.8WeaponizedEPSS 80%
- RCE
- Auth bypass
- Command injection
xplico · xplicoJan 5, 2018
CVE-2014-7221
29Monitor
TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) b
MediumCVSS 6.5Proof of conceptEPSS 10%
- Memory safety
- Denial of service
teamspeak · teamspeak3Jan 8, 2018
CVE-2014-7222
29Monitor
Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by
MediumCVSS 6.5Proof of conceptEPSS 10%
- Denial of service
teamspeak · teamspeak3Jan 8, 2018
CVE-2017-7997
45Plan
Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn
CriticalCVSS 9.8Proof of conceptEPSS 19%
- pre-auth RCE
- SQL injection
gespage · gespageJan 8, 2018
CVE-2018-0791
37Monitor
Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerabili
HighCVSS 7.8No exploitEPSS 20%
- RCE
microsoft · officeJan 9, 2018
CVE-2018-0792
44Plan
Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka
HighCVSS 8.8No exploitEPSS 28%
- pre-auth RCE
- Memory safety
microsoft · officeJan 9, 2018
CVE-2018-0793
37Monitor
Microsoft Outlook 2007, Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email m
HighCVSS 7.8No exploitEPSS 20%
- RCE
microsoft · officeJan 9, 2018
CVE-2018-0794
41Plan
Microsoft Word in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execut
HighCVSS 8.8No exploitEPSS 20%
- pre-auth RCE
microsoft · officeJan 9, 2018
CVE-2018-0795
41Plan
Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects a
HighCVSS 8.8No exploitEPSS 19%
- pre-auth RCE
microsoft · officeJan 9, 2018
CVE-2018-0796
42Plan
Microsoft Excel in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execu
HighCVSS 8.8No exploitEPSS 23%
- pre-auth RCE
microsoft · excelJan 9, 2018
CVE-2018-0797
38Monitor
Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF conte
HighCVSS 7.8No exploitEPSS 24%
- RCE
- Memory safety
microsoft · officeJan 9, 2018
CVE-2018-0798
94Now
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execu
HighCVSS 8.8KEVWeaponizedEPSS 95%
- pre-auth RCE
- Memory safety
microsoft · officeJan 9, 2018
CVE-2018-0801
42Plan
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execu
HighCVSS 8.8No exploitEPSS 24%
- pre-auth RCE
microsoft · officeJan 9, 2018
CVE-2018-0802
89Now
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execut
HighCVSS 7.8KEVWeaponizedEPSS 93%
- RCE
- Memory safety
microsoft · officeJan 9, 2018
CVE-2018-0804
42Plan
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 8.8No exploitEPSS 24%
- pre-auth RCE
microsoft · officeJan 9, 2018
CVE-2018-0805
42Plan
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 8.8No exploitEPSS 24%
- pre-auth RCE
microsoft · officeJan 9, 2018
CVE-2018-0806
42Plan
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 8.8No exploitEPSS 24%
- pre-auth RCE
microsoft · officeJan 9, 2018
CVE-2018-0807
42Plan
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 8.8No exploitEPSS 24%
- pre-auth RCE
microsoft · officeJan 9, 2018
CVE-2018-0812
38Monitor
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 7.8No exploitEPSS 24%
- RCE
- Memory safety
microsoft · officeJan 9, 2018
CVE-2016-9722
40Plan
IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by u
MediumCVSS 4.2WeaponizedEPSS 12%
- Broken access control (IDOR)
ibm · qradar security information and event managerJan 10, 2018
CVE-2017-15663
34Monitor
In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability.
HighCVSS 7.5Proof of conceptEPSS 13%
- Pre-auth
- Denial of service
flexense · disk pulseJan 10, 2018
CVE-2017-17485
54Plan
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix
CriticalCVSS 9.8Proof of conceptEPSS 49%
- pre-auth RCE
- Deserialization
fasterxml · jackson-databindJan 10, 2018
CVE-2018-5333
40Plan
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid
MediumCVSS 5.5WeaponizedEPSS 7%
- Memory safety
- Denial of service
linux · linux kernelJan 11, 2018
CVE-2018-5347
55Plan
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.p
CriticalCVSS 9.8Proof of conceptEPSS 54%
- pre-auth RCE
- Command injection
seagate · personal cloud firmwareJan 11, 2018
CVE-2018-5371
48Plan
diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticat
HighCVSS 8.8No exploitEPSS 41%
- RCE
- Command injection
d-link · dsl-2540u firmwareJan 12, 2018
CVE-2014-6435
34Monitor
cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication, which allows remote
HighCVSS 7.5Proof of conceptEPSS 12%
- Pre-auth
- Auth bypass
- Denial of service
aztech · adsl dsl5018en \(1t1r\) firmwareJan 12, 2018
CVE-2014-6436
52Plan
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authenticati
CriticalCVSS 9.8Proof of conceptEPSS 42%
- pre-auth RCE
- Auth bypass
aztech · adsl dsl5018en \(1t1r\) firmwareJan 12, 2018
CVE-2014-6437
44Plan
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via
CriticalCVSS 9.8Proof of conceptEPSS 15%
- Pre-auth
- Info leak
aztech · adsl dsl5018en \(1t1r\) firmwareJan 12, 2018
CVE-2017-16885
49Plan
Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Us
CriticalCVSS 9.8Proof of conceptEPSS 33%
- Pre-auth
fiberhome · lm53q1 firmwareJan 12, 2018
CVE-2017-16887
50Plan
The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal.
CriticalCVSS 9.8Proof of conceptEPSS 36%
- Pre-auth
fiberhome · lm53q1 firmwareJan 12, 2018
CVE-2018-5262
51Plan
A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in t
CriticalCVSS 9.8Proof of conceptEPSS 39%
- pre-auth RCE
- Memory safety
flexense · diskbossJan 12, 2018
CVE-2018-5702
39Monitor
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows r
HighCVSS 8.8Proof of conceptEPSS 11%
- pre-auth RCE
transmissionbt · transmissionJan 15, 2018
CVE-2018-5711
26Monitor
gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before
MediumCVSS 5.5Proof of conceptEPSS 13%
- Denial of service
php · phpJan 16, 2018
CVE-2018-5712
48Plan
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1.
MediumCVSS 6.1No exploitEPSS 79%
- Pre-auth
- XSS
php · phpJan 16, 2018
CVE-2018-5724
42Plan
MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore.cgi.
CriticalCVSS 9.8Proof of conceptEPSS 11%
- Pre-auth
- File upload
barni · master ip camera01 firmwareJan 16, 2018
CVE-2018-5726
45Plan
MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request, as demonstrated by t
CriticalCVSS 9.8Proof of conceptEPSS 19%
- Pre-auth
- Info leak
barni · master ip camera01 firmwareJan 16, 2018
CVE-2018-2616
43Plan
Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Diagnostic Assistant).
HighCVSS 8.8No exploitEPSS 27%
oracle · oss support toolsJan 17, 2018
CVE-2018-2636
37Monitor
Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security).
HighCVSS 8.1Proof of conceptEPSS 15%
- Pre-auth
oracle · hospitality simphonyJan 17, 2018
CVE-2016-6814
44Plan
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standar
CriticalCVSS 9.8No exploitEPSS 17%
- Pre-auth
- Deserialization
apache · groovyJan 18, 2018
CVE-2015-9251
33Monitor
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType o
MediumCVSS 6.1Proof of conceptEPSS 29%
- Pre-auth
- XSS
jquery · jqueryJan 18, 2018
CVE-2017-18044
60This week
A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6.
CriticalCVSS 9.8WeaponizedEPSS 69%
- pre-auth RCE
- Command injection
commvault · commvaultJan 19, 2018
CVE-2017-14094
45Plan
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command
CriticalCVSS 9.8Proof of conceptEPSS 19%
- pre-auth RCE
- Command injection
trendmicro · smart protection serverJan 19, 2018
CVE-2017-14095
36Monitor
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command
HighCVSS 8.1Proof of conceptEPSS 12%
- pre-auth RCE
trendmicro · smart protection serverJan 19, 2018
CVE-2017-14097
43Plan
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker
CriticalCVSS 9.8Proof of conceptEPSS 12%
- Pre-auth
trendmicro · smart protection serverJan 19, 2018
CVE-2017-14803
49Plan
In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO conne
CriticalCVSS 9.8No exploitEPSS 34%
- pre-auth RCE
netiq · access managerJan 19, 2018
CVE-2016-10708
35Monitor
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-se
HighCVSS 7.5Proof of conceptEPSS 15%
- Pre-auth
- Memory safety
- Denial of service
openbsd · opensshJan 21, 2018
CVE-2018-5955
63This week
An issue was discovered in GitStack through 2.3.10.
CriticalCVSS 9.8WeaponizedEPSS 81%
- Pre-auth
smartmobilesoftware · gitstackJan 21, 2018
CVE-2016-10709
45Plan
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php gr
HighCVSS 8.8WeaponizedEPSS 33%
- RCE
- Command injection
pfsense · pfsenseJan 22, 2018
CVE-2017-18047
60This week
Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply.
CriticalCVSS 9.8WeaponizedEPSS 19%
- pre-auth RCE
- Memory safety
labf · nfsaxeJan 22, 2018
CVE-2018-1042
31Monitor
Moodle 3.x has Server Side Request Forgery in the filepicker.
MediumCVSS 6.5Proof of conceptEPSS 16%
- SSRF
moodle · moodleJan 22, 2018
CVE-2018-5999
65This week
An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
CriticalCVSS 9.8WeaponizedEPSS 87%
- Pre-auth
asus · asuswrtJan 22, 2018
CVE-2018-6000
65This week
An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
CriticalCVSS 9.8WeaponizedEPSS 85%
- Pre-auth
- Broken access control (IDOR)
asus · asuswrtJan 22, 2018
CVE-2018-0845
37Monitor
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 7.8No exploitEPSS 19%
- RCE
microsoft · officeJan 22, 2018
CVE-2018-0848
41Plan
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 8.8No exploitEPSS 20%
- pre-auth RCE
microsoft · officeJan 22, 2018
CVE-2018-0849
41Plan
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
microsoft · officeJan 22, 2018
CVE-2018-0862
41Plan
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
microsoft · officeJan 22, 2018
CVE-2017-16597
56Plan
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7
CriticalCVSS 9.8No exploitEPSS 57%
- pre-auth RCE
- Path traversal
netgain-systems · enterprise managerJan 22, 2018
CVE-2017-16603
51Plan
This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterp
HighCVSS 8.8No exploitEPSS 54%
- Path traversal
netgain-systems · enterprise managerJan 22, 2018
CVE-2017-18048
54Plan
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (l
HighCVSS 8.8WeaponizedEPSS 63%
- RCE
- File upload
monstra · monstraJan 23, 2018
CVE-2017-2741
64This week
A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D.
CriticalCVSS 9.8WeaponizedEPSS 84%
- pre-auth RCE
hp · j9v82a firmwareJan 23, 2018
CVE-2018-5359
35Monitor
The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access becaus
HighCVSS 8.1Proof of conceptEPSS 8%
- Pre-auth
- Memory safety
flexense · sysgaugeJan 23, 2018
CVE-2018-5972
45Plan
SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listing URI.
CriticalCVSS 9.8Proof of conceptEPSS 19%
- Pre-auth
- SQL injection
quickad project · quickadJan 24, 2018
CVE-2018-5979
45Plan
SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.
CriticalCVSS 9.8Proof of conceptEPSS 19%
- Pre-auth
- SQL injection
wchat project · wchatJan 24, 2018
CVE-2018-5985
45Plan
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
CriticalCVSS 9.8Proof of conceptEPSS 19%
- Pre-auth
- SQL injection
livecrm · livecrm saas cloudJan 24, 2018
CVE-2018-5988
45Plan
SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.
CriticalCVSS 9.8Proof of conceptEPSS 19%
- Pre-auth
- SQL injection
flexible poll project · flexible pollJan 24, 2018
CVE-2017-13696
63This week
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze E
CriticalCVSS 9.8WeaponizedEPSS 78%
- Pre-auth
- Memory safety
flexense · dupscoutJan 24, 2018
CVE-2018-5319
34Monitor
RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.
HighCVSS 7.5Proof of conceptEPSS 12%
- Pre-auth
- Info leak
ravpower · filehub firmwareJan 24, 2018
CVE-2018-1000006
60This week
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, speci
HighCVSS 8.8WeaponizedEPSS 84%
- pre-auth RCE
- Command injection
atom · electronJan 24, 2018
CVE-2018-5967
21Monitor
Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.
MediumCVSS 5.4No exploitEPSS 0%
- XSS
netis-systems · wf2419 firmwareJan 25, 2018
CVE-2018-5973
45Plan
SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.php
CriticalCVSS 9.8Proof of conceptEPSS 20%
- Pre-auth
- SQL injection
eihitech · professional local directory scriptJan 25, 2018
CVE-2018-5997
46Plan
An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056.
CriticalCVSS 9.8Proof of conceptEPSS 23%
- pre-auth RCE
- Path traversal
- File upload
ravpower · filehub firmwareJan 25, 2018
CVE-2017-12377
42Plan
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a
CriticalCVSS 9.8No exploitEPSS 11%
- pre-auth RCE
- Memory safety
clamav · clamavJan 26, 2018
CVE-2017-12379
43Plan
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a
CriticalCVSS 9.8No exploitEPSS 12%
- pre-auth RCE
- Memory safety
clamav · clamavJan 26, 2018
CVE-2017-17976
43Plan
In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.
CriticalCVSS 9.8Proof of conceptEPSS 12%
- pre-auth RCE
- File upload
perfexcrm · perfex crmJan 26, 2018