Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2018

105 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2018-16133
    33Monitor

    Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.

    MediumCVSS 5.3Proof of conceptEPSS 39%

    cybrotech · cybrohttpserverAug 29, 2018

  • CVE-2018-16158
    60This week

    Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installation

    CriticalCVSS 9.8WeaponizedEPSS 34%

    eaton · power xpert meter 4000 firmwareAug 30, 2018

  • CVE-2018-15691
    44Plan

    Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    broadcom · release automationAug 30, 2018

  • CVE-2018-16159
    54Plan

    The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_do

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    codemenschen · gift vouchersAug 30, 2018

  • CVE-2018-15745
    60This week

    Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.C

    HighCVSS 7.5WeaponizedEPSS 97%

    argussurveillance · dvrAug 30, 2018