Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2018

166 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2018-6583
    45Plan

    SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    quanticalabs · timetable responsive scheduleFeb 17, 2018

  • CVE-2018-5378
    45Plan

    The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute le

    MediumCVSS 5.9No exploitEPSS 74%

    quagga · quaggaFeb 19, 2018

  • CVE-2018-5379
    51Plan

    The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing clust

    CriticalCVSS 9.8No exploitEPSS 38%

    quagga · quaggaFeb 19, 2018

  • CVE-2018-5380
    21Monitor

    The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer va

    MediumCVSS 4.3No exploitEPSS 14%

    quagga · quaggaFeb 19, 2018

  • CVE-2018-5381
    39Monitor

    The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp

    HighCVSS 7.5No exploitEPSS 30%

    quagga · quaggaFeb 19, 2018

  • CVE-2018-7251
    61This week

    An issue was discovered in config/error.php in Anchor 0.12.3.

    CriticalCVSS 9.8Proof of conceptEPSS 71%

    anchorcms · anchorFeb 19, 2018

  • CVE-2017-7376
    46Plan

    Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    xmlsoft · libxml2Feb 19, 2018

  • CVE-2016-6272
    36Monitor

    XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display string

    HighCVSS 7.5Proof of conceptEPSS 20%

    epic · mychartFeb 20, 2018

  • CVE-2017-12161
    35Monitor

    It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque

    HighCVSS 8.8No exploitEPSS 1%

    keycloak · keycloakFeb 21, 2018

  • CVE-2018-7284
    50Plan

    A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk thr

    HighCVSS 7.5Proof of conceptEPSS 66%

    digium · asteriskFeb 21, 2018

  • CVE-2018-7286
    42Plan

    An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert

    MediumCVSS 6.5Proof of conceptEPSS 52%

    digium · asteriskFeb 21, 2018

  • CVE-2018-7287
    26Monitor

    An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1.

    MediumCVSS 5.9No exploitEPSS 11%

    digium · asteriskFeb 21, 2018

  • CVE-2018-7313
    45Plan

    SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    cwjoomla · cw tagsFeb 22, 2018

  • CVE-2018-7297
    58Plan

    Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/writ

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    eq-3 · homematic central control unit ccu2 firmwareFeb 22, 2018

  • CVE-2018-7300
    48Plan

    Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earli

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    eq-3 · homematic ccu2 firmwareFeb 22, 2018

  • CVE-2018-7314
    56Plan

    SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-64

    CriticalCVSS 9.8Proof of conceptEPSS 57%

    mlwebtechnologies · prayercenterFeb 22, 2018

  • CVE-2014-3206
    54Plan

    Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or th

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    seagate · blackarmor nas 220 firmwareFeb 23, 2018

  • CVE-2018-1305
    30Monitor

    Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 t

    MediumCVSS 6.5Proof of conceptEPSS 14%

    apache · tomcatFeb 23, 2018

  • CVE-2017-18195
    24Monitor

    An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0.

    MediumCVSS 5.3Proof of conceptEPSS 11%

    concretecms · concrete cmsFeb 26, 2018

  • CVE-2018-7448
    34Monitor

    Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject

    HighCVSS 7.5Proof of conceptEPSS 12%

    cmsmadesimple · cms made simpleFeb 26, 2018

  • CVE-2018-7489
    45Plan

    FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    fasterxml · jackson-databindFeb 26, 2018

  • CVE-2018-7490
    51Plan

    uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.

    HighCVSS 7.5Proof of conceptEPSS 69%

    unbit · uwsgiFeb 26, 2018

  • CVE-2018-4872
    43Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    CriticalCVSS 10.0No exploitEPSS 11%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4879
    48Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4880
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4881
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4882
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4883
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4884
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 11%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4885
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 11%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4886
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4887
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4888
    39Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 12%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4889
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4890
    42Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 24%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4891
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4892
    39Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 12%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4893
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4894
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4895
    43Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    CriticalCVSS 9.8No exploitEPSS 13%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4896
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4897
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4898
    40Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 15%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4899
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4900
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4901
    40Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8Proof of conceptEPSS 16%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4902
    39Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 12%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4903
    33Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 22%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4904
    48Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 42%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4905
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 11%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4906
    32Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 21%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4907
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4908
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4909
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4910
    42Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 24%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4912
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 10%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4913
    39Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 13%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4914
    29Monitor

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    MediumCVSS 6.5No exploitEPSS 11%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4915
    40Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 15%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-4916
    40Plan

    An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and

    HighCVSS 8.8No exploitEPSS 15%

    adobe · acrobatFeb 27, 2018

  • CVE-2018-6481
    45Plan

    A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to execute arbitrary code

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    flexense · disksavvyFeb 27, 2018

  • CVE-2018-7467
    33Monitor

    AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.

    HighCVSS 7.5Proof of conceptEPSS 10%

    axxonsoft · nextFeb 27, 2018

  • CVE-2018-7264
    43Plan

    The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    activepdf · activepdf toolkitFeb 28, 2018

  • CVE-2015-4117
    38Monitor

    Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup p

    HighCVSS 8.8Proof of conceptEPSS 10%

    vestacp · control panelFeb 28, 2018

  • CVE-2015-5079
    35Monitor

    Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a ..

    HighCVSS 7.5Proof of conceptEPSS 17%

    blackcat-cms · blackcat cmsFeb 28, 2018

  • CVE-2018-1304
    28Monitor

    The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4

    MediumCVSS 5.9Proof of conceptEPSS 17%

    apache · tomcatFeb 28, 2018