Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2018

114 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2018-6008
    41Plan

    Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.

    HighCVSS 7.5Proof of conceptEPSS 36%

    joomlatag · jtag members directoryJan 29, 2018

  • CVE-2017-1000353
    99Now

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jenkins · jenkinsJan 29, 2018

  • CVE-2017-12626
    33Monitor

    Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF,

    HighCVSS 7.5No exploitEPSS 10%

    apache · poiJan 29, 2018

  • CVE-2018-6383
    39Monitor

    Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .pha

    HighCVSS 8.8Proof of conceptEPSS 13%

    monstra · monstraJan 29, 2018

  • CVE-2018-0101
    66This week

    A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an u

    CriticalCVSS 10.0Proof of conceptEPSS 86%

    cisco · adaptive security appliance softwareJan 29, 2018

  • CVE-2018-6397
    34Monitor

    Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.

    HighCVSS 7.5Proof of conceptEPSS 11%

    joomlacalendars · picture calendarJan 30, 2018

  • CVE-2018-6377
    41Plan

    In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio,

    MediumCVSS 6.1No exploitEPSS 56%

    joomla · joomla\!Jan 30, 2018

  • CVE-2016-6598
    45Plan

    BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010.

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    bmc · track-it\!Jan 30, 2018

  • CVE-2016-6599
    43Plan

    BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010.

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    bmc · track-it\!Jan 30, 2018

  • CVE-2018-6407
    40Plan

    An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices.

    HighCVSS 7.5Proof of conceptEPSS 32%

    conceptronic · cipcamptiwl firmwareJan 30, 2018

  • CVE-2018-1000001
    40Plan

    In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer

    HighCVSS 7.8WeaponizedEPSS 13%

    gnu · glibcJan 31, 2018

  • CVE-2018-6460
    33Monitor

    Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895.

    HighCVSS 7.5Proof of conceptEPSS 10%

    anchorfree · hotspot shieldJan 31, 2018

  • CVE-2014-1632
    35Monitor

    htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.

    HighCVSS 8.1Proof of conceptEPSS 10%

    eventum project · eventumJan 31, 2018

  • CVE-2018-5701
    45Plan

    In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not vali

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    iolo · system shieldJan 31, 2018