Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2018

114 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2018-2380
    65This week

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thu

    MediumCVSS 6.6KEVWeaponizedEPSS 28%

    sap · customer relationship managementMar 1, 2018

  • CVE-2018-7573
    60This week

    An issue was discovered in FTPShell Client 6.7.

    CriticalCVSS 9.8WeaponizedEPSS 69%

    ftpshell · ftpshell clientMar 1, 2018

  • CVE-2018-7584
    65This week

    In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while pa

    CriticalCVSS 9.8Proof of conceptEPSS 87%

    php · phpMar 1, 2018

  • CVE-2017-14461
    33Monitor

    A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensi

    HighCVSS 7.1No exploitEPSS 16%

    dovecot · dovecotMar 2, 2018

  • CVE-2018-1058
    39Monitor

    A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.

    HighCVSS 8.8Proof of conceptEPSS 13%

    postgresql · postgresqlMar 2, 2018

  • CVE-2018-7583
    41Plan

    Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.

    HighCVSS 7.5Proof of conceptEPSS 38%

    advantig · dualdeskMar 3, 2018

  • CVE-2018-7662
    35Monitor

    Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpm

    MediumCVSS 5.3Proof of conceptEPSS 47%

    couchcms · couchMar 4, 2018

  • CVE-2018-7665
    60This week

    An issue was discovered in ClipBucket before 4.0.0 Release 4902.

    CriticalCVSS 9.8WeaponizedEPSS 15%

    clip-bucket · clipbucketMar 5, 2018

  • CVE-2018-1000115
    60This week

    Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP

    HighCVSS 7.5WeaponizedEPSS 88%

    memcached · memcachedMar 5, 2018

  • CVE-2018-0491
    34Monitor

    A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10.

    HighCVSS 7.5Proof of conceptEPSS 14%

    torproject · torMar 5, 2018

  • CVE-2017-17428
    60This week

    Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leve

    MediumCVSS 5.9WeaponizedEPSS 14%

    cavium · nitrox ssl sdkMar 5, 2018

  • CVE-2015-5377
    43Plan

    Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    elastic · elasticsearchMar 6, 2018

  • CVE-2018-6530
    98Now

    OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    dlink · dir-860l firmwareMar 6, 2018

  • CVE-2018-7182
    39Monitor

    The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via

    HighCVSS 7.5Proof of conceptEPSS 28%

    ntp · ntpMar 6, 2018

  • CVE-2018-7739
    55Plan

    antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters,

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    antsle · antmanMar 6, 2018

  • CVE-2018-7745
    34Monitor

    An issue was discovered in Western Bridge Cobub Razor 0.7.2.

    HighCVSS 7.5Proof of conceptEPSS 12%

    cobub · razorMar 7, 2018

  • CVE-2017-15367
    46Plan

    Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    bacula · bacula-webMar 7, 2018

  • CVE-2018-0147
    74This week

    A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthe

    CriticalCVSS 9.8KEVWeaponizedEPSS 18%

    cisco · secure access control systemMar 8, 2018

  • CVE-2018-1216
    45Plan

    A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enab

    CriticalCVSS 9.8No exploitEPSS 21%

    dell · emc solutions enabler virtual applianceMar 8, 2018

  • CVE-2018-7183
    42Plan

    Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by lever

    CriticalCVSS 9.8No exploitEPSS 10%

    ntp · ntpMar 8, 2018

  • CVE-2018-7890
    63This week

    A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640).

    CriticalCVSS 9.8WeaponizedEPSS 78%

    zohocorp · manageengine applications managerMar 8, 2018

  • CVE-2018-7582
    41Plan

    WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.

    HighCVSS 7.5Proof of conceptEPSS 36%

    weblogexpert · weblog expertMar 9, 2018

  • CVE-2018-8056
    34Monitor

    Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/manage/channel/addchan

    HighCVSS 7.5Proof of conceptEPSS 12%

    cobub · razorMar 11, 2018

  • CVE-2018-8057
    46Plan

    A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    westernbridgegroup · razorMar 11, 2018

  • CVE-2018-8065
    60This week

    An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24.

    HighCVSS 7.5WeaponizedEPSS 75%

    flexense · syncbreezeMar 12, 2018

  • CVE-2017-2619
    33Monitor

    Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the serv

    HighCVSS 7.5Proof of conceptEPSS 11%

    samba · sambaMar 12, 2018

  • CVE-2018-1323
    44Plan

    The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to

    HighCVSS 7.5Proof of conceptEPSS 46%

    apache · tomcat jk connectorMar 12, 2018

  • CVE-2018-1000094
    40Plan

    CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admi

    HighCVSS 7.2WeaponizedEPSS 38%

    cmsmadesimple · cms made simpleMar 12, 2018

  • CVE-2018-1057
    38Monitor

    On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LD

    HighCVSS 8.8No exploitEPSS 10%

    samba · sambaMar 13, 2018

  • CVE-2017-1002101
    42Plan

    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with

    CriticalCVSS 9.6Proof of conceptEPSS 12%

    kubernetes · kubernetesMar 13, 2018

  • CVE-2018-7750
    47Plan

    transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    paramiko · paramikoMar 13, 2018

  • CVE-2018-8096
    53Plan

    Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticatione

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    datalust · seqMar 13, 2018

  • CVE-2018-1000129
    31Monitor

    An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript i

    MediumCVSS 6.1Proof of conceptEPSS 24%

    jolokia · jolokiaMar 14, 2018

  • CVE-2018-1000130
    54Plan

    A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java c

    HighCVSS 8.1Proof of conceptEPSS 73%

    jolokia · webarchive agentMar 14, 2018

  • CVE-2018-5782
    45Plan

    A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    mitel · connect onsiteMar 14, 2018

  • CVE-2018-0872
    35Monitor

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0873
    35Monitor

    ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to h

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0874
    35Monitor

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0876
    35Monitor

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0878
    18Monitor

    Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2

    LowCVSS 3.1Proof of conceptEPSS 21%

    microsoft · windows 10Mar 14, 2018

  • CVE-2018-0883
    34Monitor

    Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · windows 10Mar 14, 2018

  • CVE-2018-0886
    53Plan

    The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and

    HighCVSS 7.0Proof of conceptEPSS 81%

    microsoft · windows 10Mar 14, 2018

  • CVE-2018-0889
    35Monitor

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · internet explorerMar 14, 2018

  • CVE-2018-0891
    21Monitor

    ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server

    MediumCVSS 4.3Proof of conceptEPSS 14%

    microsoft · internet explorerMar 14, 2018

  • CVE-2018-0893
    38Monitor

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en

    HighCVSS 7.5No exploitEPSS 26%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0903
    36Monitor

    Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code exec

    HighCVSS 7.8No exploitEPSS 15%

    microsoft · accessMar 14, 2018

  • CVE-2018-0919
    16Monitor

    Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2

    LowCVSS 3.3No exploitEPSS 11%

    microsoft · officeMar 14, 2018

  • CVE-2018-0922
    36Monitor

    Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibil

    HighCVSS 7.8No exploitEPSS 17%

    microsoft · officeMar 14, 2018

  • CVE-2018-0925
    33Monitor

    ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory

    HighCVSS 7.5No exploitEPSS 11%

    microsoft · chakracoreMar 14, 2018

  • CVE-2018-0930
    33Monitor

    ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles obje

    HighCVSS 7.5No exploitEPSS 11%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0931
    33Monitor

    ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr

    HighCVSS 7.5No exploitEPSS 11%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0933
    50Plan

    ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr

    HighCVSS 7.5Proof of conceptEPSS 66%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0934
    50Plan

    ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr

    HighCVSS 7.5Proof of conceptEPSS 66%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0935
    47Plan

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi

    HighCVSS 7.5Proof of conceptEPSS 55%

    microsoft · internet explorerMar 14, 2018

  • CVE-2018-0936
    35Monitor

    ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0937
    35Monitor

    ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in mem

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMar 14, 2018

  • CVE-2018-0941
    26Monitor

    Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vu

    MediumCVSS 5.5No exploitEPSS 12%

    microsoft · exchange serverMar 14, 2018

  • CVE-2018-1000120
    42Plan

    A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of se

    CriticalCVSS 9.8No exploitEPSS 11%

    debian · debian linuxMar 14, 2018

  • CVE-2018-6328
    60This week

    It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allo

    CriticalCVSS 9.8WeaponizedEPSS 64%

    kaseya · unitrends backupMar 14, 2018

  • CVE-2018-6329
    60This week

    It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a

    CriticalCVSS 9.8WeaponizedEPSS 61%

    unitrends · backupMar 14, 2018

  • CVE-2018-7702
    40Plan

    SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to ar

    CriticalCVSS 9.1Proof of conceptEPSS 13%

    securenvoy · securmailMar 14, 2018

  • CVE-2018-7756
    57Plan

    RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which al

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    dewesoft · dewesoftMar 14, 2018

  • CVE-2018-8045
    43Plan

    In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User

    HighCVSS 8.8Proof of conceptEPSS 28%

    joomla · joomla\!Mar 14, 2018

  • CVE-2018-8715
    39Monitor

    The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c.

    HighCVSS 8.1Proof of conceptEPSS 22%

    embedthis · appwebMar 14, 2018

  • CVE-2018-6223
    42Plan

    A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to man

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    trendmicro · email encryption gatewayMar 15, 2018

  • CVE-2018-6228
    42Plan

    A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    trendmicro · email encryption gatewayMar 15, 2018

  • CVE-2018-6229
    42Plan

    A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL comma

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    trendmicro · email encryption gatewayMar 15, 2018

  • CVE-2018-8770
    39Monitor

    Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.

    MediumCVSS 5.3Proof of conceptEPSS 59%

    cobub · razorMar 18, 2018

  • CVE-2018-7422
    49Plan

    A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil

    HighCVSS 7.5Proof of conceptEPSS 62%

    siteeditor · site editorMar 19, 2018

  • CVE-2018-1218
    35Monitor

    In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes

    HighCVSS 7.5Proof of conceptEPSS 15%

    dell · emc networkerMar 19, 2018

  • CVE-2014-2674
    35Monitor

    Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary

    HighCVSS 7.5Proof of conceptEPSS 15%

    ajax-pagination project · ajax-paginationMar 19, 2018

  • CVE-2018-7445
    87Now

    A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.

    CriticalCVSS 9.8KEVWeaponizedEPSS 60%

    mikrotik · routerosMar 19, 2018

  • CVE-2017-17215
    58Plan

    Huawei HG532 with some customized versions has a remote code execution vulnerability.

    HighCVSS 8.8Proof of conceptEPSS 78%

    huawei · hg532 firmwareMar 20, 2018

  • CVE-2018-8088
    43Plan

    org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restric

    CriticalCVSS 9.8No exploitEPSS 14%

    qos · slf4jMar 20, 2018

  • CVE-2018-1321
    33Monitor

    An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1

    HighCVSS 7.2Proof of conceptEPSS 17%

    apache · syncopeMar 20, 2018

  • CVE-2018-1322
    25Monitor

    An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and

    MediumCVSS 4.9Proof of conceptEPSS 19%

    apache · syncopeMar 20, 2018

  • CVE-2018-8828
    48Plan

    A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2.

    CriticalCVSS 9.8No exploitEPSS 30%

    kamailio · kamailioMar 20, 2018

  • CVE-2018-1207
    66This week

    Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code.

    CriticalCVSS 9.8Proof of conceptEPSS 90%

    dell · emc idrac7Mar 23, 2018

  • CVE-2017-17736
    60This week

    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/insta

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    kentico · xperienceMar 23, 2018

  • CVE-2018-7719
    44Plan

    Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.

    HighCVSS 7.5Proof of conceptEPSS 46%

    acrolinx · acrolinx serverMar 25, 2018

  • CVE-2018-8947
    33Monitor

    rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attack

    HighCVSS 7.5Proof of conceptEPSS 11%

    laravel log viewer project · laravel log viewerMar 25, 2018

  • CVE-2017-15710
    35Monitor

    In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the

    HighCVSS 7.5No exploitEPSS 17%

    apache · http serverMar 26, 2018

  • CVE-2017-15715
    58Plan

    In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, ra

    HighCVSS 8.1Proof of conceptEPSS 85%

    apache · http serverMar 26, 2018

  • CVE-2018-1301
    27Monitor

    A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size li

    MediumCVSS 5.9No exploitEPSS 14%

    apache · http serverMar 26, 2018

  • CVE-2018-1302
    27Monitor

    When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer po

    MediumCVSS 5.9No exploitEPSS 12%

    apache · http serverMar 26, 2018

  • CVE-2018-1303
    51Plan

    A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while

    HighCVSS 7.5No exploitEPSS 69%

    apache · http serverMar 26, 2018

  • CVE-2018-1312
    44Plan

    In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not co

    CriticalCVSS 9.8No exploitEPSS 15%

    apache · http serverMar 26, 2018

  • CVE-2018-1189
    27Monitor

    Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affe

    MediumCVSS 4.8Proof of conceptEPSS 27%

    dell · emc isilonMar 26, 2018

  • CVE-2018-7658
    42Plan

    NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by s

    HighCVSS 7.5Proof of conceptEPSS 38%

    softros · network time systemMar 26, 2018

  • CVE-2018-9032
    47Plan

    An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmwar

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    dlink · dir-850l firmwareMar 26, 2018

  • CVE-2017-12319
    60This week

    A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow a

    MediumCVSS 5.9KEVWeaponizedEPSS 5%

    cisco · iosMar 27, 2018

  • CVE-2018-7700
    57Plan

    DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify

    HighCVSS 8.8Proof of conceptEPSS 74%

    dedecms · dedecmsMar 27, 2018

  • CVE-2018-6882
    63This week

    Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7

    MediumCVSS 6.1KEVWeaponizedEPSS 29%

    synacor · zimbra collaboration suiteMar 27, 2018

  • CVE-2018-0739
    32Monitor

    Constructed ASN.1 types with a recursive definition could exceed the stack

    MediumCVSS 6.5No exploitEPSS 18%

    openssl · opensslMar 27, 2018

  • CVE-2018-8823
    54Plan

    modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 thro

    CriticalCVSS 9.8Proof of conceptEPSS 50%

    prestashop · prestashopMar 27, 2018

  • CVE-2018-0151
    73This week

    A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, re

    CriticalCVSS 9.8KEVWeaponizedEPSS 14%

    cisco · ios xeMar 28, 2018

  • CVE-2018-0154
    62This week

    A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an una

    HighCVSS 7.5KEVWeaponizedEPSS 7%

    cisco · iosMar 28, 2018

  • CVE-2018-0155
    66This week

    A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Cata

    HighCVSS 8.6KEVWeaponizedEPSS 7%

    cisco · iosMar 28, 2018

  • CVE-2018-0156
    63This week

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker

    HighCVSS 7.5KEVWeaponizedEPSS 9%

    cisco · iosMar 28, 2018

  • CVE-2018-0158
    66This week

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthe

    HighCVSS 8.6KEVWeaponizedEPSS 7%

    cisco · iosMar 28, 2018