Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: апрель 2017 г.

91 записей · 9 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2017-1001000
    60На этой неделе

    The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 84 %

    wordpress · wordpress2 апр. 2017 г.

  • CVE-2014-1677
    35Наблюдать

    Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.

    ВысокаяCVSS 7,5Proof of conceptEPSS 17 %

    technicolor · tc7200 firmware3 апр. 2017 г.

  • CVE-2017-7397
    33Наблюдать

    BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian sourc

    ВысокаяCVSS 7,5Proof of conceptEPSS 11 %

    backbox · backbox linux3 апр. 2017 г.

  • CVE-2016-10229
    43В плане

    udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checks

    КритическаяCVSS 9,8Эксплойта нетEPSS 12 %

    linux · linux kernel4 апр. 2017 г.

  • CVE-2017-7413
    47В плане

    In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an

    ВысокаяCVSS 8,8Эксплойта нетEPSS 39 %

    horde · groupware4 апр. 2017 г.

  • CVE-2016-3740
    36Наблюдать

    Heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to

    ВысокаяCVSS 7,8Эксплойта нетEPSS 15 %

    foxitsoftware · foxit reader4 апр. 2017 г.

  • CVE-2017-6884
    75На этой неделе

    A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8.

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 32 %

    zyxel · emg2926 firmware6 апр. 2017 г.

  • CVE-2016-8735
    96Срочно

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 90 %

    apache · tomcat6 апр. 2017 г.

  • CVE-2017-7577
    47В плане

    XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request.

    КритическаяCVSS 9,8Эксплойта нетEPSS 28 %

    xiongmaitech · uc-httpd7 апр. 2017 г.

  • CVE-2017-7581
    60На этой неделе

    SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arb

    КритическаяCVSS 9,8Готовый эксплойтEPSS 48 %

    news system project · news system7 апр. 2017 г.

  • CVE-2017-0561
    48В плане

    A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary code within the con

    КритическаяCVSS 9,8Proof of conceptEPSS 29 %

    linux · linux kernel7 апр. 2017 г.

  • CVE-2017-6019
    41В плане

    An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830.

    ВысокаяCVSS 7,5Proof of conceptEPSS 36 %

    schneider-electric · conext combox 865-1058 firmware7 апр. 2017 г.

  • CVE-2017-6190
    36Наблюдать

    Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to

    ВысокаяCVSS 7,5Proof of conceptEPSS 18 %

    dlink · dwr-116 firmware10 апр. 2017 г.

  • CVE-2017-5983
    44В плане

    The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    atlassian · jira10 апр. 2017 г.

  • CVE-2017-7185
    34Наблюдать

    Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Libra

    ВысокаяCVSS 7,5Proof of conceptEPSS 12 %

    cesanta · mongoose embedded web server library10 апр. 2017 г.

  • CVE-2017-7461
    22Наблюдать

    Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows re

    СредняяCVSS 4,9Proof of conceptEPSS 10 %

    intellinet-network · nfc-30ir firmware11 апр. 2017 г.

  • CVE-2017-7462
    43В плане

    Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web direc

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    intellinet-network · nfc-30ir firmware11 апр. 2017 г.

  • CVE-2016-1908
    43В плане

    The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for acc

    КритическаяCVSS 9,8Эксплойта нетEPSS 13 %

    openbsd · openssh11 апр. 2017 г.

  • CVE-2016-7547
    67На этой неделе

    A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.c

    КритическаяCVSS 9,8Готовый эксплойтEPSS 92 %

    trendmicro · threat discovery appliance12 апр. 2017 г.

  • CVE-2016-7552
    67На этой неделе

    On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthent

    КритическаяCVSS 9,8Готовый эксплойтEPSS 93 %

    trendmicro · threat discovery appliance12 апр. 2017 г.

  • CVE-2017-7588
    49В плане

    On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attemp

    КритическаяCVSS 9,8Proof of conceptEPSS 33 %

    brother · mfc firmware12 апр. 2017 г.

  • CVE-2017-0093
    34Наблюдать

    A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory

    ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %

    microsoft · edge12 апр. 2017 г.

  • CVE-2017-0106
    40В плане

    Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execu

    ВысокаяCVSS 7,8Proof of conceptEPSS 28 %

    microsoft · outlook12 апр. 2017 г.

  • CVE-2017-0158
    34Наблюдать

    An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.1 Windows RT 8.1, an

    ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %

    microsoft · windows 1012 апр. 2017 г.

  • CVE-2017-0160
    36Наблюдать

    Microsoft .NET Framework 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allows an attacker with access to the local system to execute malicious

    ВысокаяCVSS 7,8Proof of conceptEPSS 17 %

    microsoft · .net framework12 апр. 2017 г.

  • CVE-2017-0194
    30Наблюдать

    Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2 allow remote attackers to obtain sensitive information

    СредняяCVSS 5,5Эксплойта нетEPSS 25 %

    microsoft · excel12 апр. 2017 г.

  • CVE-2017-0197
    37Наблюдать

    Microsoft OneNote 2007 SP3 and Microsoft OneNote 2010 SP2 allow remote attackers to execute arbitrary code via a crafted document, aka "Micr

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · onenote12 апр. 2017 г.

  • CVE-2017-0199
    91Срочно

    Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 99 %

    microsoft · office12 апр. 2017 г.

  • CVE-2017-0200
    34Наблюдать

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %

    microsoft · edge12 апр. 2017 г.

  • CVE-2017-0201
    34Наблюдать

    A remote code execution vulnerability exists in Internet Explorer in the way that the JScript and VBScript engines render when handling obje

    ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %

    microsoft · internet explorer12 апр. 2017 г.

  • CVE-2017-0202
    44В плане

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.

    ВысокаяCVSS 7,5Proof of conceptEPSS 45 %

    microsoft · internet explorer12 апр. 2017 г.

  • CVE-2017-0204
    28Наблюдать

    Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to byp

    СредняяCVSS 5,5Proof of conceptEPSS 19 %

    microsoft · outlook12 апр. 2017 г.

  • CVE-2017-0205
    37Наблюдать

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 23 %

    microsoft · edge12 апр. 2017 г.

  • CVE-2017-0207
    29Наблюдать

    Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Brow

    СредняяCVSS 6,5Эксплойта нетEPSS 10 %

    microsoft · outlook12 апр. 2017 г.

  • CVE-2017-0208
    22Наблюдать

    An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory

    СредняяCVSS 4,3Эксплойта нетEPSS 15 %

    microsoft · edge12 апр. 2017 г.

  • CVE-2017-0210
    72На этой неделе

    An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 22 %

    microsoft · internet explorer12 апр. 2017 г.

  • CVE-2017-0211
    26Наблюдать

    An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and

    СредняяCVSS 5,5Proof of conceptEPSS 14 %

    microsoft · windows 1012 апр. 2017 г.

  • CVE-2017-3006
    38Наблюдать

    Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation o

    ВысокаяCVSS 8,8Proof of conceptEPSS 10 %

    adobe · creative cloud12 апр. 2017 г.

  • CVE-2017-3022
    17Наблюдать

    Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerabili

    НизкаяCVSS 3,3Эксплойта нетEPSS 11 %

    adobe · acrobat12 апр. 2017 г.

  • CVE-2017-3042
    35Наблюдать

    Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable heap overflow vuln

    ВысокаяCVSS 7,8Эксплойта нетEPSS 14 %

    adobe · acrobat12 апр. 2017 г.

  • CVE-2017-3044
    37Наблюдать

    Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption

    ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %

    adobe · acrobat12 апр. 2017 г.

  • CVE-2017-3048
    35Наблюдать

    Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable heap overflow vuln

    ВысокаяCVSS 7,8Эксплойта нетEPSS 13 %

    adobe · acrobat12 апр. 2017 г.

  • CVE-2017-3055
    35Наблюдать

    Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable heap overflow vuln

    ВысокаяCVSS 7,8Эксплойта нетEPSS 14 %

    adobe · acrobat12 апр. 2017 г.

  • CVE-2017-3061
    46В плане

    Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability in the SWF parser.

    КритическаяCVSS 9,8Proof of conceptEPSS 24 %

    adobe · flash player12 апр. 2017 г.

  • CVE-2017-3064
    35Наблюдать

    Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline.

    ВысокаяCVSS 7,8Proof of conceptEPSS 13 %

    adobe · flash player12 апр. 2017 г.

  • CVE-2017-7722
    60На этой неделе

    In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and

    КритическаяCVSS 10,0Готовый эксплойтEPSS 12 %

    solarwinds · log \& event manager12 апр. 2017 г.

  • CVE-2016-6808
    46В плане

    Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.

    КритическаяCVSS 9,8Эксплойта нетEPSS 22 %

    apache · tomcat jk connector12 апр. 2017 г.

  • CVE-2016-2555
    63На этой неделе

    SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands v

    КритическаяCVSS 9,8Готовый эксплойтEPSS 79 %

    atutor · atutor13 апр. 2017 г.

  • CVE-2016-4970
    33Наблюдать

    handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of

    ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %

    netty · netty13 апр. 2017 г.

  • CVE-2017-7857
    40В плане

    FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in true

    КритическаяCVSS 9,8Эксплойта нетEPSS 3 %

    freetype · freetype14 апр. 2017 г.

  • CVE-2017-7455
    35Наблюдать

    Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.

    ВысокаяCVSS 7,5Proof of conceptEPSS 15 %

    moxa · mxview14 апр. 2017 г.

  • CVE-2017-7456
    39Наблюдать

    Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credent

    ВысокаяCVSS 7,5Proof of conceptEPSS 29 %

    moxa · mxview14 апр. 2017 г.

  • CVE-2015-6567
    38Наблюдать

    Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanage

    ВысокаяCVSS 8,8Proof of conceptEPSS 10 %

    wolfcms · wolf cms14 апр. 2017 г.

  • CVE-2015-6568
    38Наблюдать

    Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanage

    ВысокаяCVSS 8,8Proof of conceptEPSS 10 %

    wolfcms · wolf cms14 апр. 2017 г.

  • CVE-2016-1713
    40В плане

    Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDeta

    ВысокаяCVSS 7,3Готовый эксплойтEPSS 16 %

    vtiger · vtiger crm14 апр. 2017 г.

  • CVE-2016-5312
    42В плане

    Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to

    СредняяCVSS 6,5Proof of conceptEPSS 53 %

    symantec · messaging gateway14 апр. 2017 г.

  • CVE-2017-6554
    33Наблюдать

    pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to write to arbitrary fil

    ВысокаяCVSS 7,2Proof of conceptEPSS 15 %

    quest · privilege manager14 апр. 2017 г.

  • CVE-2017-7696
    41В плане

    SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large va

    ВысокаяCVSS 7,5Эксплойта нетEPSS 36 %

    sap · sso authentication library14 апр. 2017 г.

  • CVE-2017-7615
    62На этой неделе

    MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 91 %

    mantisbt · mantisbt16 апр. 2017 г.

  • CVE-2015-8256
    39Наблюдать

    Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.

    СредняяCVSS 6,1Proof of conceptEPSS 50 %

    axis · network camera firmware17 апр. 2017 г.

  • CVE-2017-5647
    35Наблюдать

    A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.7

    ВысокаяCVSS 7,5Эксплойта нетEPSS 16 %

    apache · tomcat17 апр. 2017 г.

  • CVE-2017-5648
    40В плане

    While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.

    КритическаяCVSS 9,1Эксплойта нетEPSS 13 %

    apache · tomcat17 апр. 2017 г.

  • CVE-2017-5645
    66На этой неделе

    In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic

    КритическаяCVSS 9,8Proof of conceptEPSS 89 %

    apache · log4j17 апр. 2017 г.

  • CVE-2017-7896
    60На этой неделе

    Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.

    СредняяCVSS 6,1Готовый эксплойтEPSS 4 %

    trendmicro · interscan messaging security virtual appliance18 апр. 2017 г.

  • CVE-2017-5653
    24Наблюдать

    JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypt

    СредняяCVSS 5,3Эксплойта нетEPSS 11 %

    apache · cxf18 апр. 2017 г.

  • CVE-2017-7692
    45В плане

    SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file th

    ВысокаяCVSS 8,8Proof of conceptEPSS 32 %

    squirrelmail · squirrelmail20 апр. 2017 г.

  • CVE-2016-1555
    98Срочно

    (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 98 %

    netgear · wnap320 firmware21 апр. 2017 г.

  • CVE-2017-8051
    44В плане

    Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI.

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    tenable · appliance21 апр. 2017 г.

  • CVE-2016-1560
    61На этой неделе

    ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the

    КритическаяCVSS 9,8Готовый эксплойтEPSS 72 %

    exagrid · ex3000 firmware21 апр. 2017 г.

  • CVE-2016-1561
    60На этой неделе

    ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote atta

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 74 %

    exagrid · ex3000 firmware21 апр. 2017 г.

  • CVE-2016-3109
    47В плане

    The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.

    КритическаяCVSS 9,8Эксплойта нетEPSS 28 %

    shopware · shopware21 апр. 2017 г.

  • CVE-2015-7245
    44В плане

    Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read

    ВысокаяCVSS 7,5Proof of conceptEPSS 45 %

    d-link · dvg-n5402sp firmware24 апр. 2017 г.

  • CVE-2015-7246
    43В плане

    D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw

    КритическаяCVSS 9,8Proof of conceptEPSS 14 %

    d-link · dvg-n5402sp firmware24 апр. 2017 г.

  • CVE-2015-7247
    42В плане

    D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes

    КритическаяCVSS 9,8Proof of conceptEPSS 10 %

    d-link · dvg-n5402sp firmware24 апр. 2017 г.

  • CVE-2017-3506
    88Срочно

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

    ВысокаяCVSS 7,4KEVГотовый эксплойтEPSS 95 %

    oracle · weblogic server24 апр. 2017 г.

  • CVE-2017-3528
    25Наблюдать

    Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datep

    СредняяCVSS 5,4Proof of conceptEPSS 14 %

    oracle · applications framework24 апр. 2017 г.

  • CVE-2017-3548
    41В плане

    Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker).

    СредняяCVSS 6,5Proof of conceptEPSS 50 %

    oracle · peoplesoft enterprise peopletools24 апр. 2017 г.

  • CVE-2017-3549
    41В плане

    Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration).

    КритическаяCVSS 9,1Proof of conceptEPSS 15 %

    oracle · scripting24 апр. 2017 г.

  • CVE-2017-3599
    57В плане

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth).

    ВысокаяCVSS 7,5Proof of conceptEPSS 89 %

    oracle · mysql24 апр. 2017 г.

  • CVE-2017-3622
    40В плане

    Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)).

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 5 %

    oracle · solaris24 апр. 2017 г.

  • CVE-2017-3623
    47В плане

    Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC).

    КритическаяCVSS 10,0Proof of conceptEPSS 22 %

    oracle · solaris24 апр. 2017 г.

  • CVE-2017-5030
    77На этой неделе

    Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 40 %

    google · chrome24 апр. 2017 г.

  • CVE-2017-5040
    24Наблюдать

    V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which all

    СредняяCVSS 4,3Эксплойта нетEPSS 23 %

    google · chrome24 апр. 2017 г.

  • CVE-2017-8220
    50В плане

    TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP reques

    КритическаяCVSS 9,9Эксплойта нетEPSS 37 %

    tp-link · c2 firmware25 апр. 2017 г.

  • CVE-2017-8225
    50В плане

    On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked.

    КритическаяCVSS 9,8Proof of conceptEPSS 35 %

    wificam · wireless ip camera \(p2p\) firmware25 апр. 2017 г.

  • CVE-2017-8291
    90Срочно

    Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 96 %

    artifex · ghostscript26 апр. 2017 г.

  • CVE-2017-3066
    96Срочно

    Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializa

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 90 %

    adobe · coldfusion27 апр. 2017 г.

  • CVE-2017-5135
    41В плане

    Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases.

    КритическаяCVSS 9,1Proof of conceptEPSS 17 %

    technicolor · dpc3928sl firmware27 апр. 2017 г.

  • CVE-2017-7895
    42В плане

    The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows rem

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    linux · linux kernel28 апр. 2017 г.

  • CVE-2017-6553
    60На этой неделе

    Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the polic

    КритическаяCVSS 9,8Готовый эксплойтEPSS 42 %

    quest · privilege manager for unix29 апр. 2017 г.

  • CVE-2017-7981
    40В плане

    Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin.

    ВысокаяCVSS 8,8Proof of conceptEPSS 16 %

    enalean · tuleap29 апр. 2017 г.