Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2018

121 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2018-12814
    42Plan

    Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability.

    CriticalCVSS 9.8No exploitEPSS 11%

    adobe · digital editionsOct 17, 2018

  • CVE-2018-12386
    36Monitor

    A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write.

    HighCVSS 8.1Proof of conceptEPSS 13%

    redhat · enterprise linux desktopOct 18, 2018

  • CVE-2015-4632
    46Plan

    Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before

    HighCVSS 7.5Proof of conceptEPSS 51%

    koha · kohaOct 18, 2018

  • CVE-2018-18284
    39Monitor

    Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.

    HighCVSS 8.6No exploitEPSS 16%

    artifex · ghostscriptOct 19, 2018

  • CVE-2018-18428
    33Monitor

    TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI.

    HighCVSS 7.5Proof of conceptEPSS 11%

    tp-link · tl-sc3130 firmwareOct 19, 2018

  • CVE-2018-18557
    39Monitor

    LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta,

    HighCVSS 8.8Proof of conceptEPSS 14%

    libtiff · libtiffOct 22, 2018

  • CVE-2018-15704
    41Plan

    Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability.

    HighCVSS 8.8No exploitEPSS 21%

    advantech · webaccessOct 22, 2018

  • CVE-2018-8569
    35Monitor

    A remote code execution vulnerability exists in the Yammer desktop application due to the loading of arbitrary content, aka "Yammer Desktop

    HighCVSS 7.8No exploitEPSS 13%

    microsoft · yammerOct 23, 2018

  • CVE-2017-18349
    51Plan

    parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbi

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    pippo · pippoOct 23, 2018

  • CVE-2018-17445
    42Plan

    A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.

    CriticalCVSS 9.8No exploitEPSS 11%

    citrix · netscaler sd-wanOct 23, 2018

  • CVE-2018-18475
    45Plan

    Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.

    CriticalCVSS 9.8No exploitEPSS 20%

    zohocorp · manageengine opmanagerOct 23, 2018

  • CVE-2018-15442
    40Plan

    Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

    HighCVSS 7.8WeaponizedEPSS 16%

    cisco · webex meetings desktopOct 24, 2018

  • CVE-2018-3971
    31Monitor

    An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744.

    HighCVSS 7.8No exploitEPSS 0%

    sophos · hitmanpro.alertOct 25, 2018

  • CVE-2018-14665
    40Plan

    A flaw was found in xorg-x11-server before 1.20.3.

    MediumCVSS 6.6WeaponizedEPSS 27%

    x.org · x serverOct 25, 2018

  • CVE-2018-18778
    47Plan

    ACME mini_httpd before 1.30 lets remote users read arbitrary files.

    MediumCVSS 6.5Proof of conceptEPSS 70%

    acme · mini-httpdOct 29, 2018

  • CVE-2018-0734
    27Monitor

    Timing attack against DSA

    MediumCVSS 5.9No exploitEPSS 12%

    openssl · opensslOct 30, 2018

  • CVE-2018-14558
    72This week

    An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318

    CriticalCVSS 9.8KEVWeaponizedEPSS 8%

    tenda · ac7 firmwareOct 30, 2018

  • CVE-2018-18850
    40Plan

    In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could uplo

    HighCVSS 8.8WeaponizedEPSS 12%

    octopus · octopus serverOct 30, 2018

  • CVE-2018-11759
    57Plan

    The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK

    HighCVSS 7.5Proof of conceptEPSS 90%

    apache · tomcat jk connectorOct 31, 2018

  • CVE-2018-15705
    30Monitor

    WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesyste

    MediumCVSS 6.5Proof of conceptEPSS 12%

    advantech · webaccessOct 31, 2018

  • CVE-2018-15706
    36Monitor

    WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a dir

    MediumCVSS 6.5No exploitEPSS 32%

    advantech · webaccessOct 31, 2018