Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2018

93 records · 7 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2017-17020
    39Monitor

    On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with

    HighCVSS 8.8Proof of conceptEPSS 14%

    dlink · dcs-5009 firmwareMay 1, 2018

  • CVE-2018-10583
    60This week

    An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate

    HighCVSS 7.5WeaponizedEPSS 78%

    libreoffice · libreofficeMay 1, 2018

  • CVE-2016-10036
    47Plan

    Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbit

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    jfrog · artifactoryMay 1, 2018

  • CVE-2018-8115
    44Plan

    A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input w

    HighCVSS 8.6Proof of conceptEPSS 34%

    microsoft · windows host compute service shimMay 2, 2018

  • CVE-2018-0258
    53Plan

    A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary f

    CriticalCVSS 9.8No exploitEPSS 47%

    cisco · prime data center network managerMay 2, 2018

  • CVE-2018-10718
    49Plan

    Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute a

    CriticalCVSS 10.0Proof of conceptEPSS 31%

    activision · call of duty modern warfare 2May 3, 2018

  • CVE-2018-10561
    97Now

    An issue was discovered on Dasan GPON home routers.

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    dasannetworks · gpon router firmwareMay 3, 2018

  • CVE-2018-10562
    99Now

    An issue was discovered on Dasan GPON home routers.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    dasannetworks · gpon router firmwareMay 3, 2018

  • CVE-2018-0494
    31Monitor

    GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation

    MediumCVSS 6.5Proof of conceptEPSS 16%

    gnu · wgetMay 6, 2018

  • CVE-2018-1247
    33Monitor

    RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability.

    HighCVSS 7.1Proof of conceptEPSS 15%

    rsa · authentication managerMay 8, 2018

  • CVE-2018-1000168
    33Monitor

    nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that ca

    HighCVSS 7.5No exploitEPSS 10%

    nghttp2 · nghttp2May 8, 2018

  • CVE-2018-8897
    40Plan

    A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the

    HighCVSS 7.8WeaponizedEPSS 18%

    debian · debian linuxMay 8, 2018

  • CVE-2015-1503
    47Plan

    Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) ..

    HighCVSS 7.5Proof of conceptEPSS 57%

    icewarp · mail serverMay 8, 2018

  • CVE-2018-0824
    87Now

    A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Micros

    HighCVSS 8.8KEVWeaponizedEPSS 73%

    microsoft · windows 10 1507May 9, 2018

  • CVE-2018-0943
    35Monitor

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-0945
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-0946
    45Plan

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    HighCVSS 7.5Proof of conceptEPSS 51%

    microsoft · edgeMay 9, 2018

  • CVE-2018-0951
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-0953
    50Plan

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    HighCVSS 7.5Proof of conceptEPSS 66%

    microsoft · edgeMay 9, 2018

  • CVE-2018-0954
    35Monitor

    A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-0955
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · internet explorerMay 9, 2018

  • CVE-2018-1022
    35Monitor

    A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8114
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · internet explorerMay 9, 2018

  • CVE-2018-8120
    80Now

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k

    HighCVSS 7.0KEVWeaponizedEPSS 73%

    microsoft · windows 7May 9, 2018

  • CVE-2018-8122
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · internet explorerMay 9, 2018

  • CVE-2018-8128
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8130
    35Monitor

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8133
    45Plan

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    HighCVSS 7.5Proof of conceptEPSS 50%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8136
    38Monitor

    A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka "Windows Remote Code Execution Vulnerabi

    HighCVSS 7.8No exploitEPSS 23%

    microsoft · windows 10May 9, 2018

  • CVE-2018-8137
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8139
    50Plan

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    HighCVSS 7.5Proof of conceptEPSS 66%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8145
    50Plan

    An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker

    HighCVSS 7.5Proof of conceptEPSS 66%

    microsoft · chakracoreMay 9, 2018

  • CVE-2018-8147
    38Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · excelMay 9, 2018

  • CVE-2018-8148
    38Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · excelMay 9, 2018

  • CVE-2018-8154
    46Plan

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak

    CriticalCVSS 9.8No exploitEPSS 23%

    microsoft · exchange serverMay 9, 2018

  • CVE-2018-8157
    38Monitor

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · officeMay 9, 2018

  • CVE-2018-8158
    38Monitor

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · officeMay 9, 2018

  • CVE-2018-8161
    37Monitor

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    HighCVSS 7.8No exploitEPSS 21%

    microsoft · officeMay 9, 2018

  • CVE-2018-8162
    38Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · excelMay 9, 2018

  • CVE-2018-8163
    26Monitor

    An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In

    MediumCVSS 5.5No exploitEPSS 12%

    microsoft · excelMay 9, 2018

  • CVE-2018-8173
    37Monitor

    A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Micros

    HighCVSS 7.8No exploitEPSS 19%

    microsoft · infopathMay 9, 2018

  • CVE-2018-8174
    86Now

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Rem

    HighCVSS 7.5KEVWeaponizedEPSS 88%

    microsoft · windows 10 1607May 9, 2018

  • CVE-2018-8177
    33Monitor

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    HighCVSS 7.5No exploitEPSS 11%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8178
    35Monitor

    A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeMay 9, 2018

  • CVE-2018-8179
    34Monitor

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · edgeMay 9, 2018

  • CVE-2018-10942
    43Plan

    modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attacke

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    prestashop · prestashopMay 9, 2018

  • CVE-2018-10655
    36Monitor

    DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH).

    HighCVSS 7.8Proof of conceptEPSS 15%

    devicelock · plug and play auditorMay 10, 2018

  • CVE-2018-1260
    42Plan

    Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versio

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    pivotal software · spring security oauthMay 11, 2018

  • CVE-2018-6361
    35Monitor

    Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account.

    MediumCVSS 6.1No exploitEPSS 37%

    ehcp · easy hosting control panelMay 11, 2018

  • CVE-2018-5230
    35Monitor

    The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4

    MediumCVSS 6.1Proof of conceptEPSS 37%

    atlassian · jiraMay 14, 2018

  • CVE-2017-12128
    42Plan

    An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317.

    HighCVSS 7.5No exploitEPSS 40%

    moxa · edr-810 firmwareMay 14, 2018

  • CVE-2018-11094
    49Plan

    An issue was discovered on Intelbras NCLOUD 300 1.0 devices.

    CriticalCVSS 9.8Proof of conceptEPSS 33%

    intelbras · ncloud 300 firmwareMay 15, 2018

  • CVE-2018-10123
    38Monitor

    p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100.

    HighCVSS 8.8Proof of conceptEPSS 10%

    intenogroup · iopsys firmwareMay 16, 2018

  • CVE-2018-10735
    41Plan

    A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.

    HighCVSS 7.2Proof of conceptEPSS 42%

    nagios · nagios xiMay 16, 2018

  • CVE-2018-10736
    41Plan

    A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.

    HighCVSS 7.2Proof of conceptEPSS 42%

    nagios · nagios xiMay 16, 2018

  • CVE-2018-10737
    41Plan

    A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.

    HighCVSS 7.2Proof of conceptEPSS 42%

    nagios · nagios xiMay 16, 2018

  • CVE-2018-10738
    41Plan

    A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.

    HighCVSS 7.2Proof of conceptEPSS 42%

    nagios · nagios xiMay 16, 2018

  • CVE-2018-8014
    45Plan

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.8

    CriticalCVSS 9.8No exploitEPSS 21%

    apache · tomcatMay 16, 2018

  • CVE-2018-9948
    60This week

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935.

    MediumCVSS 6.5WeaponizedEPSS 63%

    foxitsoftware · foxit readerMay 17, 2018

  • CVE-2018-9958
    60This week

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049.

    HighCVSS 8.8WeaponizedEPSS 62%

    foxitsoftware · foxit readerMay 17, 2018

  • CVE-2018-1111
    59Plan

    DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager i

    HighCVSS 7.5WeaponizedEPSS 97%

    fedoraproject · fedoraMay 17, 2018

  • CVE-2018-11130
    37Monitor

    The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-

    HighCVSS 7.8No exploitEPSS 20%

    vcftools project · vcftoolsMay 17, 2018

  • CVE-2018-9250
    44Plan

    interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlist

    HighCVSS 8.8No exploitEPSS 31%

    open-emr · openemrMay 18, 2018

  • CVE-2018-4917
    44Plan

    Adobe Acrobat and Reader versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, 2015.006.30394 and earlier have an exploitable hea

    CriticalCVSS 9.8No exploitEPSS 17%

    adobe · acrobat 2017May 19, 2018

  • CVE-2018-4918
    43Plan

    Adobe Acrobat and Reader versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, 2015.006.30394 and earlier have an exploitable out

    CriticalCVSS 9.8No exploitEPSS 11%

    adobe · acrobatMay 19, 2018

  • CVE-2018-4924
    43Plan

    Adobe Dreamweaver CC versions 18.0 and earlier have an OS Command Injection vulnerability.

    CriticalCVSS 9.8No exploitEPSS 14%

    adobe · dreamweaverMay 19, 2018

  • CVE-2018-4934
    32Monitor

    Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability.

    MediumCVSS 6.5Proof of conceptEPSS 19%

    adobe · flash player desktop runtimeMay 19, 2018

  • CVE-2018-4935
    43Plan

    Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.

    HighCVSS 8.8Proof of conceptEPSS 25%

    adobe · flash player desktop runtimeMay 19, 2018

  • CVE-2018-4936
    33Monitor

    Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability.

    MediumCVSS 6.5Proof of conceptEPSS 24%

    adobe · flash player desktop runtimeMay 19, 2018

  • CVE-2018-4937
    43Plan

    Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.

    HighCVSS 8.8Proof of conceptEPSS 25%

    adobe · flash player desktop runtimeMay 19, 2018

  • CVE-2018-4939
    88Now

    Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untruste

    CriticalCVSS 9.8KEVWeaponizedEPSS 61%

    adobe · coldfusionMay 19, 2018

  • CVE-2018-11311
    41Plan

    A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FT

    CriticalCVSS 9.1Proof of conceptEPSS 15%

    myscada · myproMay 20, 2018

  • CVE-2018-3639
    40Plan

    Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior mem

    MediumCVSS 5.5Proof of conceptEPSS 60%

    intel · atom cMay 22, 2018

  • CVE-2018-10094
    60This week

    SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer

    CriticalCVSS 9.8WeaponizedEPSS 69%

    dolibarr · dolibarrMay 22, 2018

  • CVE-2018-10095
    50Plan

    Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the for

    MediumCVSS 6.1Proof of conceptEPSS 86%

    dolibarr · dolibarrMay 22, 2018

  • CVE-2018-8176
    42Plan

    A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka

    HighCVSS 8.8No exploitEPSS 23%

    microsoft · office for macMay 23, 2018

  • CVE-2018-10354
    39Monitor

    A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to exec

    HighCVSS 8.8No exploitEPSS 12%

    trendmicro · email encryption gatewayMay 23, 2018

  • CVE-2018-10357
    54Plan

    A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code

    HighCVSS 8.8No exploitEPSS 64%

    trendmicro · endpoint application controlMay 23, 2018

  • CVE-2018-8898
    43Plan

    A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    dlink · dsl-3782 firmwareMay 23, 2018

  • CVE-2018-8013
    45Plan

    In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the cla

    CriticalCVSS 9.8No exploitEPSS 18%

    apache · batikMay 24, 2018

  • CVE-2018-11412
    28Monitor

    In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in ce

    MediumCVSS 5.9Proof of conceptEPSS 15%

    linux · linux kernelMay 24, 2018

  • CVE-2018-1133
    44Plan

    An issue was discovered in Moodle 3.x.

    HighCVSS 8.8Proof of conceptEPSS 31%

    moodle · moodleMay 25, 2018

  • CVE-2018-10350
    39Monitor

    A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to

    HighCVSS 8.8No exploitEPSS 14%

    trendmicro · smart protection serverMay 25, 2018

  • CVE-2018-11479
    40Plan

    The VPN component in Windscribe 1.81 uses the OpenVPN client for connections.

    HighCVSS 7.8WeaponizedEPSS 9%

    windscribe · windscribeMay 25, 2018

  • CVE-2018-6409
    25Monitor

    An issue was discovered in Appnitro MachForm before 4.2.3.

    MediumCVSS 5.3Proof of conceptEPSS 14%

    machform · machformMay 26, 2018

  • CVE-2018-1235
    52Plan

    Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    emc · recoverpointMay 29, 2018

  • CVE-2018-10466
    44Plan

    Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection.

    CriticalCVSS 9.8No exploitEPSS 16%

    zohocorp · manageengine adaudit plusMay 29, 2018

  • CVE-2018-11235
    45Plan

    In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can

    HighCVSS 7.8Proof of conceptEPSS 48%

    debian · debian linuxMay 30, 2018

  • CVE-2018-11220
    40Plan

    Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.

    HighCVSS 8.8Proof of conceptEPSS 15%

    bitmain · antminer d3 firmwareMay 31, 2018

  • CVE-2018-11132
    40Plan

    In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue tha

    HighCVSS 8.8No exploitEPSS 18%

    quest · kace system management applianceMay 31, 2018

  • CVE-2018-11138
    97Now

    The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    quest · kace system management applianceMay 31, 2018

  • CVE-2018-11139
    48Plan

    The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated

    HighCVSS 8.8No exploitEPSS 42%

    quest · kace system management applianceMay 31, 2018

  • CVE-2016-10542
    60This week

    ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".

    HighCVSS 7.5WeaponizedEPSS 7%

    ws project · wsMay 31, 2018