Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2018

99 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2018-11646
    60This week

    webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebK

    HighCVSS 7.5WeaponizedEPSS 68%

    webkitgtk · webkitgtk\+Jun 1, 2018

  • CVE-2018-11652
    46Plan

    CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HT

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    cirt.net · niktoJun 1, 2018

  • CVE-2018-11552
    32Monitor

    There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field.

    MediumCVSS 6.1No exploitEPSS 28%

    nch · axon pbxJun 1, 2018

  • CVE-2018-11538
    39Monitor

    servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSR

    HighCVSS 8.8Proof of conceptEPSS 12%

    searchblox · searchbloxJun 1, 2018

  • CVE-2018-11143
    50Plan

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).

    CriticalCVSS 9.8No exploitEPSS 36%

    quest · disk backupJun 1, 2018

  • CVE-2018-10613
    35Monitor

    Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and

    HighCVSS 7.5No exploitEPSS 17%

    ge · mds pulsenetJun 4, 2018

  • CVE-2018-11714
    59Plan

    An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0

    CriticalCVSS 9.8Proof of conceptEPSS 67%

    tp-link · tl-wr840n firmwareJun 4, 2018

  • CVE-2018-11586
    43Plan

    XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files o

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    searchblox · searchbloxJun 5, 2018

  • CVE-2017-16082
    42Plan

    A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    node-postgres · pgJun 6, 2018

  • CVE-2017-16086
    60This week

    ua-parser is a port of Browserscope's user agent parser.

    HighCVSS 7.5WeaponizedEPSS 9%

    ua-parser project · ua-parserJun 6, 2018

  • CVE-2018-0296
    90Now

    A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    cisco · adaptive security appliance softwareJun 7, 2018

  • CVE-2018-12031
    45Plan

    Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory t

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    eaton · intelligent power managerJun 7, 2018

  • CVE-2018-3758
    43Plan

    Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

    HighCVSS 8.8No exploitEPSS 27%

    express-cart project · express-cartJun 7, 2018

  • CVE-2018-12053
    33Monitor

    Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using director

    HighCVSS 7.5Proof of conceptEPSS 10%

    schools alert management script project · schools alert management scriptJun 8, 2018

  • CVE-2018-12054
    41Plan

    Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.

    HighCVSS 7.5Proof of conceptEPSS 37%

    schools alert management script project · schools alert management scriptJun 8, 2018

  • CVE-2018-10088
    51Plan

    Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    xiongmaitech · uc-httpdJun 8, 2018

  • CVE-2018-11409
    60This week

    Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demon

    MediumCVSS 5.3WeaponizedEPSS 98%

    splunk · splunkJun 8, 2018

  • CVE-2018-4192
    34Monitor

    An issue was discovered in certain Apple products.

    HighCVSS 7.5Proof of conceptEPSS 11%

    apple · safariJun 8, 2018

  • CVE-2018-4222
    38Monitor

    An issue was discovered in certain Apple products.

    HighCVSS 8.8Proof of conceptEPSS 10%

    apple · safariJun 8, 2018

  • CVE-2018-4233
    60This week

    An issue was discovered in certain Apple products.

    HighCVSS 8.8WeaponizedEPSS 53%

    apple · safariJun 8, 2018

  • CVE-2018-4237
    40Plan

    An issue was discovered in certain Apple products.

    HighCVSS 7.8WeaponizedEPSS 13%

    apple · iphone osJun 8, 2018

  • CVE-2018-4243
    36Monitor

    An issue was discovered in certain Apple products.

    HighCVSS 7.8Proof of conceptEPSS 18%

    apple · apple tvJun 8, 2018

  • CVE-2016-9066
    34Monitor

    A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data.

    HighCVSS 7.5Proof of conceptEPSS 12%

    mozilla · firefoxJun 11, 2018

  • CVE-2016-9079
    86Now

    A use-after-free vulnerability in SVG Animation has been discovered.

    HighCVSS 7.5KEVWeaponizedEPSS 87%

    debian · debian linuxJun 11, 2018

  • CVE-2016-9899
    45Plan

    Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    debian · debian linuxJun 11, 2018

  • CVE-2017-5375
    49Plan

    JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    redhat · enterprise linux desktopJun 11, 2018

  • CVE-2017-5404
    44Plan

    A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    debian · debian linuxJun 11, 2018

  • CVE-2017-5415
    25Monitor

    An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion

    MediumCVSS 5.3Proof of conceptEPSS 12%

    mozilla · firefoxJun 11, 2018

  • CVE-2017-5447
    41Plan

    An out-of-bounds read during the processing of glyph widths during text layout.

    CriticalCVSS 9.1Proof of conceptEPSS 16%

    debian · debian linuxJun 11, 2018

  • CVE-2017-5465
    41Plan

    An out-of-bounds read while processing SVG content in "ConvolvePixel".

    CriticalCVSS 9.1Proof of conceptEPSS 18%

    debian · debian linuxJun 11, 2018

  • CVE-2017-7783
    34Monitor

    If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example.com"), the resultin

    HighCVSS 7.5Proof of conceptEPSS 13%

    mozilla · firefoxJun 11, 2018

  • CVE-2018-5093
    36Monitor

    A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially exploitable crash.

    HighCVSS 7.5No exploitEPSS 19%

    mozilla · firefoxJun 11, 2018

  • CVE-2018-5094
    34Monitor

    A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collection on memory that

    HighCVSS 7.5No exploitEPSS 14%

    mozilla · firefoxJun 11, 2018

  • CVE-2018-5146
    39Monitor

    An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.

    HighCVSS 8.8Proof of conceptEPSS 11%

    redhat · enterprise linux desktopJun 11, 2018

  • CVE-2018-5158
    38Monitor

    The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafte

    HighCVSS 8.8Proof of conceptEPSS 10%

    debian · debian linuxJun 11, 2018

  • CVE-2018-5159
    45Plan

    An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possib

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    debian · debian linuxJun 11, 2018

  • CVE-2018-6961
    88Now

    VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component.

    HighCVSS 8.1KEVWeaponizedEPSS 85%

    vmware · nsx sd-wan by velocloudJun 11, 2018

  • CVE-2018-0732
    44Plan

    Client DoS due to large DH parameter

    HighCVSS 7.5No exploitEPSS 48%

    openssl · opensslJun 12, 2018

  • CVE-2018-0978
    35Monitor

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · internet explorerJun 14, 2018

  • CVE-2018-8110
    35Monitor

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · edgeJun 14, 2018

  • CVE-2018-8111
    35Monitor

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · edgeJun 14, 2018

  • CVE-2018-8210
    38Monitor

    A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution Vulnerabi

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · windows 10Jun 14, 2018

  • CVE-2018-8225
    39Monitor

    A remote code execution vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses,

    HighCVSS 8.1No exploitEPSS 23%

    microsoft · windows 10Jun 14, 2018

  • CVE-2018-8226
    34Monitor

    A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.

    HighCVSS 7.5No exploitEPSS 13%

    microsoft · windows 10Jun 14, 2018

  • CVE-2018-8227
    35Monitor

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · edgeJun 14, 2018

  • CVE-2018-8229
    51Plan

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    HighCVSS 7.5Proof of conceptEPSS 71%

    microsoft · edgeJun 14, 2018

  • CVE-2018-8231
    37Monitor

    A remote code execution vulnerability exists when HTTP Protocol Stack (Http.sys) improperly handles objects in memory, aka "HTTP Protocol St

    HighCVSS 8.1No exploitEPSS 16%

    microsoft · windows 10Jun 14, 2018

  • CVE-2018-8236
    34Monitor

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · edgeJun 14, 2018

  • CVE-2018-8239
    39Monitor

    An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows

    MediumCVSS 5.5No exploitEPSS 57%

    microsoft · windows 10Jun 14, 2018

  • CVE-2018-8243
    34Monitor

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

    HighCVSS 7.5No exploitEPSS 12%

    microsoft · chakracoreJun 14, 2018

  • CVE-2018-8245
    36Monitor

    A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when i

    HighCVSS 7.8No exploitEPSS 16%

    microsoft · publisherJun 14, 2018

  • CVE-2018-8246
    28Monitor

    An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In

    MediumCVSS 5.5No exploitEPSS 18%

    microsoft · excelJun 14, 2018

  • CVE-2018-8248
    37Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    HighCVSS 7.8No exploitEPSS 21%

    microsoft · officeJun 14, 2018

  • CVE-2018-8249
    34Monitor

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · internet explorerJun 14, 2018

  • CVE-2018-8267
    35Monitor

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · internet explorerJun 14, 2018

  • CVE-2018-11690
    34Monitor

    The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper vali

    MediumCVSS 6.1No exploitEPSS 32%

    balbooa · gridboxJun 14, 2018

  • CVE-2018-12453
    37Monitor

    Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-se

    HighCVSS 7.5Proof of conceptEPSS 23%

    redislabs · redisJun 16, 2018

  • CVE-2018-11218
    60This week

    Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0

    CriticalCVSS 9.8WeaponizedEPSS 59%

    redislabs · redisJun 17, 2018

  • CVE-2018-12533
    45Plan

    JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbit

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    redhat · richfacesJun 18, 2018

  • CVE-2015-4664
    45Plan

    An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    broadcom · privileged access managerJun 18, 2018

  • CVE-2018-1333
    35Monitor

    DoS for HTTP/2 connections by crafted requests

    HighCVSS 7.5No exploitEPSS 17%

    apache · http serverJun 18, 2018

  • CVE-2018-9022
    43Plan

    An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code o

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    broadcom · privileged access managerJun 18, 2018

  • CVE-2018-11116
    36Monitor

    OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call a

    HighCVSS 8.8No exploitEPSS 2%

    openwrt · openwrtJun 19, 2018

  • CVE-2018-12293
    38Monitor

    The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKit

    HighCVSS 8.8Proof of conceptEPSS 10%

    canonical · ubuntu linuxJun 19, 2018

  • CVE-2018-12327
    47Plan

    Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher pri

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    ntp · ntpJun 20, 2018

  • CVE-2018-12604
    34Monitor

    GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.

    HighCVSS 7.5Proof of conceptEPSS 13%

    njtech · greencmsJun 20, 2018

  • CVE-2018-0301
    44Plan

    A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the manag

    CriticalCVSS 9.8No exploitEPSS 17%

    cisco · nx-osJun 20, 2018

  • CVE-2018-12617
    38Monitor

    qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overfl

    HighCVSS 7.5Proof of conceptEPSS 25%

    qemu · qemuJun 21, 2018

  • CVE-2018-12613
    65This week

    An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the serve

    HighCVSS 8.8WeaponizedEPSS 98%

    phpmyadmin · phpmyadminJun 21, 2018

  • CVE-2018-12634
    56Plan

    CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    circontrol · circarlife scadaJun 21, 2018

  • CVE-2018-12636
    37Monitor

    The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via th

    HighCVSS 7.2Proof of conceptEPSS 29%

    ithemes · securityJun 22, 2018

  • CVE-2018-12692
    44Plan

    TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell me

    HighCVSS 8.8No exploitEPSS 28%

    tp-link · tl-wa850re firmwareJun 23, 2018

  • CVE-2018-12693
    31Monitor

    Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to cause a

    MediumCVSS 6.5No exploitEPSS 15%

    tp-link · tl-wa850re firmwareJun 23, 2018

  • CVE-2018-12713
    37Monitor

    GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demon

    CriticalCVSS 9.1No exploitEPSS 1%

    gimp · gimpJun 24, 2018

  • CVE-2018-10956
    46Plan

    IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.

    HighCVSS 7.5Proof of conceptEPSS 54%

    ipconfigure · orchid core vmsJun 25, 2018

  • CVE-2018-0598
    34Monitor

    Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker t

    HighCVSS 7.8No exploitEPSS 10%

    microsoft · windowsJun 26, 2018

  • CVE-2017-7657
    43Plan

    In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled

    CriticalCVSS 9.8No exploitEPSS 14%

    eclipse · jettyJun 26, 2018

  • CVE-2018-1000517
    49Plan

    BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Bu

    CriticalCVSS 9.8No exploitEPSS 32%

    busybox · busyboxJun 26, 2018

  • CVE-2018-1000528
    38Monitor

    GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change pa

    MediumCVSS 6.1No exploitEPSS 46%

    gonicus · gosaJun 26, 2018

  • CVE-2018-1000533
    61This week

    klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` functio

    CriticalCVSS 9.8WeaponizedEPSS 72%

    gitlist · gitlistJun 26, 2018

  • CVE-2017-7658
    45Plan

    In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when pr

    CriticalCVSS 9.8No exploitEPSS 19%

    eclipse · jettyJun 26, 2018

  • CVE-2018-1000600
    62This week

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java t

    HighCVSS 8.8Proof of conceptEPSS 90%

    jenkins · githubJun 26, 2018

  • CVE-2018-10660
    64This week

    An issue was discovered in multiple models of Axis IP Cameras.

    CriticalCVSS 9.8WeaponizedEPSS 82%

    axis · a1001 firmwareJun 26, 2018

  • CVE-2018-10661
    65This week

    An issue was discovered in multiple models of Axis IP Cameras.

    CriticalCVSS 9.8WeaponizedEPSS 86%

    axis · a1001 firmwareJun 26, 2018

  • CVE-2018-10662
    63This week

    An issue was discovered in multiple models of Axis IP Cameras.

    CriticalCVSS 9.8WeaponizedEPSS 79%

    axis · a1001 firmwareJun 26, 2018

  • CVE-2018-3760
    38Monitor

    There is an information leak vulnerability in Sprockets.

    HighCVSS 7.5Proof of conceptEPSS 26%

    redhat · cloudformsJun 26, 2018

  • CVE-2018-10594
    60This week

    Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, E

    CriticalCVSS 9.8WeaponizedEPSS 68%

    deltaww · commgrJun 26, 2018

  • CVE-2018-12895
    54Plan

    WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param

    HighCVSS 8.8WeaponizedEPSS 62%

    wordpress · wordpressJun 26, 2018

  • CVE-2018-12900
    43Plan

    Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.

    HighCVSS 8.8No exploitEPSS 25%

    libtiff · libtiffJun 26, 2018

  • CVE-2018-12905
    37Monitor

    joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.

    MediumCVSS 6.1No exploitEPSS 42%

    joyplus-cms project · joyplus-cmsJun 27, 2018

  • CVE-2018-12908
    42Plan

    Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    brynamics · brynamicsJun 27, 2018

  • CVE-2018-12909
    35Monitor

    Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has acc

    HighCVSS 7.5Proof of conceptEPSS 16%

    webgrind project · webgrindJun 27, 2018

  • CVE-2018-1306
    43Plan

    The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain se

    HighCVSS 7.5Proof of conceptEPSS 43%

    apache · plutoJun 27, 2018

  • CVE-2018-11510
    52Plan

    The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cg

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    asustor · admJun 28, 2018

  • CVE-2018-12589
    37Monitor

    Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working

    HighCVSS 7.8Proof of conceptEPSS 20%

    polarisoffice · polaris office 2017Jun 28, 2018

  • CVE-2018-12998
    54Plan

    A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manage

    MediumCVSS 6.1Proof of conceptEPSS 99%

    zohocorp · firewall analyzerJun 29, 2018

  • CVE-2018-12464
    63This week

    Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway

    CriticalCVSS 9.8WeaponizedEPSS 80%

    microfocus · secure messaging gatewayJun 29, 2018

  • CVE-2018-12465
    52Plan

    Remote Code Execution in Micro Focus Secure Messaging Gateway

    HighCVSS 7.2WeaponizedEPSS 80%

    microfocus · secure messaging gatewayJun 29, 2018

  • CVE-2018-10860
    43Plan

    perl-archive-zip is vulnerable to a directory traversal in Archive::Zip.

    HighCVSS 7.5No exploitEPSS 43%

    canonical · ubuntu linuxJun 29, 2018