Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: август 2017 г.

109 записей · 6 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

Страница 1 из 2

  • CVE-2017-8572
    26Наблюдать

    Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows

    СредняяCVSS 5,5Эксплойта нетEPSS 12 %

    microsoft · outlook1 авг. 2017 г.

  • CVE-2017-8663
    37Наблюдать

    Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows

    ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %

    microsoft · outlook1 авг. 2017 г.

  • CVE-2015-2560
    44В плане

    Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an a

    КритическаяCVSS 9,8Эксплойта нетEPSS 15 %

    zohocorp · manageengine desktop central2 авг. 2017 г.

  • CVE-2017-9769
    65На этой неделе

    A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a

    КритическаяCVSS 9,8Готовый эксплойтEPSS 85 %

    razer · synapse2 авг. 2017 г.

  • CVE-2017-11383
    51В плане

    SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input

    КритическаяCVSS 9,8Эксплойта нетEPSS 38 %

    trendmicro · control manager2 авг. 2017 г.

  • CVE-2017-11384
    51В плане

    SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input

    КритическаяCVSS 9,8Эксплойта нетEPSS 38 %

    trendmicro · control manager2 авг. 2017 г.

  • CVE-2017-11385
    51В плане

    SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input

    КритическаяCVSS 9,8Эксплойта нетEPSS 38 %

    trendmicro · control manager2 авг. 2017 г.

  • CVE-2017-11386
    46В плане

    SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input

    КритическаяCVSS 9,8Эксплойта нетEPSS 24 %

    trendmicro · control manager2 авг. 2017 г.

  • CVE-2017-11387
    34Наблюдать

    Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functi

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    trendmicro · control manager2 авг. 2017 г.

  • CVE-2017-11388
    39Наблюдать

    SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate u

    ВысокаяCVSS 8,8Эксплойта нетEPSS 14 %

    trendmicro · control manager2 авг. 2017 г.

  • CVE-2017-11389
    47В плане

    Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files

    КритическаяCVSS 9,8Эксплойта нетEPSS 27 %

    trendmicro · control manager2 авг. 2017 г.

  • CVE-2017-7442
    60На этой неделе

    Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 40 %

    gonitro · nitro pro3 авг. 2017 г.

  • CVE-2017-11391
    54В плане

    Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute ar

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 62 %

    trendmicro · interscan messaging security virtual appliance3 авг. 2017 г.

  • CVE-2017-11392
    45В плане

    Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute ar

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 34 %

    trendmicro · interscan messaging security virtual appliance3 авг. 2017 г.

  • CVE-2017-11393
    44В плане

    Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerab

    КритическаяCVSS 9,8Эксплойта нетEPSS 15 %

    trendmicro · officescan3 авг. 2017 г.

  • CVE-2017-11394
    60На этой неделе

    Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerab

    КритическаяCVSS 9,8Готовый эксплойтEPSS 66 %

    trendmicro · officescan3 авг. 2017 г.

  • CVE-2017-6663
    57В плане

    A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent

    СредняяCVSS 6,5KEVГотовый эксплойтEPSS 2 %

    cisco · ios7 авг. 2017 г.

  • CVE-2017-12477
    60На этой неделе

    It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in

    КритическаяCVSS 9,8Готовый эксплойтEPSS 68 %

    kaseya · unitrends backup7 авг. 2017 г.

  • CVE-2017-12478
    62На этой неделе

    It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameter

    КритическаяCVSS 9,8Готовый эксплойтEPSS 78 %

    kaseya · unitrends backup7 авг. 2017 г.

  • CVE-2017-12479
    39Наблюдать

    It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable du

    ВысокаяCVSS 8,8Proof of conceptEPSS 11 %

    kaseya · unitrends backup7 авг. 2017 г.

  • CVE-2014-9260
    38Наблюдать

    The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every Word

    ВысокаяCVSS 8,8Proof of conceptEPSS 11 %

    w3eden · download manager7 авг. 2017 г.

  • CVE-2015-7704
    33Наблюдать

    The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of craft

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2015-7705
    43В плане

    The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large n

    КритическаяCVSS 9,8Эксплойта нетEPSS 12 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2015-7849
    40В плане

    Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly exec

    ВысокаяCVSS 8,8Эксплойта нетEPSS 16 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2015-7852
    27Наблюдать

    ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 re

    СредняяCVSS 5,9Эксплойта нетEPSS 12 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2015-7853
    43В плане

    The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitra

    КритическаяCVSS 9,8Эксплойта нетEPSS 11 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2015-7854
    39Наблюдать

    Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated us

    ВысокаяCVSS 8,8Эксплойта нетEPSS 14 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2015-7855
    35Наблюдать

    The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service

    СредняяCVSS 6,5Proof of conceptEPSS 31 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2015-7871
    64На этой неделе

    Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.

    КритическаяCVSS 9,8Готовый эксплойтEPSS 81 %

    ntp · ntp7 авг. 2017 г.

  • CVE-2016-7976
    60На этой неделе

    The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 23 %

    artifex · ghostscript7 авг. 2017 г.

  • CVE-2017-12637
    89Срочно

    Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 95 %

    sap · netweaver application server java7 авг. 2017 г.

  • CVE-2017-10075
    37Наблюдать

    Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server).

    ВысокаяCVSS 8,2Proof of conceptEPSS 17 %

    oracle · webcenter content8 авг. 2017 г.

  • CVE-2017-10246
    36Наблюдать

    Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp).

    ВысокаяCVSS 8,2Proof of conceptEPSS 13 %

    oracle · application object library8 авг. 2017 г.

  • CVE-2017-11151
    44В плане

    A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    synology · photo station8 авг. 2017 г.

  • CVE-2017-11152
    34Наблюдать

    Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers

    ВысокаяCVSS 7,5Proof of conceptEPSS 14 %

    synology · photo station8 авг. 2017 г.

  • CVE-2017-11153
    43В плане

    Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    synology · photo station8 авг. 2017 г.

  • CVE-2017-11155
    44В плане

    An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtai

    ВысокаяCVSS 7,5Proof of conceptEPSS 47 %

    synology · photo station8 авг. 2017 г.

  • CVE-2017-0250
    38Наблюдать

    Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT

    ВысокаяCVSS 7,8Эксплойта нетEPSS 23 %

    microsoft · windows 108 авг. 2017 г.

  • CVE-2017-0293
    34Наблюдать

    Microsoft Windows PDF Library in Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold,

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8620
    49В плане

    Windows Search in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 1

    ВысокаяCVSS 8,1Эксплойта нетEPSS 57 %

    microsoft · windows 108 авг. 2017 г.

  • CVE-2017-8625
    40В плане

    Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Int

    ВысокаяCVSS 8,8Proof of conceptEPSS 15 %

    microsoft · internet explorer8 авг. 2017 г.

  • CVE-2017-8634
    51В плане

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way t

    ВысокаяCVSS 7,5Proof of conceptEPSS 70 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8635
    47В плане

    Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo

    ВысокаяCVSS 7,5Proof of conceptEPSS 55 %

    microsoft · internet explorer8 авг. 2017 г.

  • CVE-2017-8636
    52В плане

    Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo

    ВысокаяCVSS 7,5Proof of conceptEPSS 72 %

    microsoft · internet explorer8 авг. 2017 г.

  • CVE-2017-8640
    51В плане

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of

    ВысокаяCVSS 7,5Proof of conceptEPSS 69 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8641
    51В плане

    Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo

    ВысокаяCVSS 7,5Proof of conceptEPSS 71 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8644
    22Наблюдать

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the

    СредняяCVSS 4,3Proof of conceptEPSS 15 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8645
    51В плане

    Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the cu

    ВысокаяCVSS 7,5Proof of conceptEPSS 69 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8646
    51В плане

    Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the cu

    ВысокаяCVSS 7,5Proof of conceptEPSS 69 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8652
    33Наблюдать

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the

    СредняяCVSS 6,5Proof of conceptEPSS 22 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8656
    51В плане

    Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of th

    ВысокаяCVSS 7,5Proof of conceptEPSS 69 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8657
    46В плане

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    ВысокаяCVSS 7,5Proof of conceptEPSS 54 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8670
    51В плане

    Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of th

    ВысокаяCVSS 7,5Proof of conceptEPSS 68 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8671
    51В плане

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    ВысокаяCVSS 7,5Proof of conceptEPSS 69 %

    microsoft · edge8 авг. 2017 г.

  • CVE-2017-8691
    41В плане

    Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font li

    ВысокаяCVSS 8,8Эксплойта нетEPSS 19 %

    microsoft · windows 78 авг. 2017 г.

  • CVE-2015-0786
    46В плане

    Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) all

    КритическаяCVSS 9,8Эксплойта нетEPSS 23 %

    novell · zenworks configuration management9 авг. 2017 г.

  • CVE-2015-2291
    64На этой неделе

    (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to c

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 9 %

    intel · ethernet diagnostics driver iqvw32.sys9 авг. 2017 г.

  • CVE-2017-8518
    33Наблюдать

    Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, aka "Scripting Engine Memory Corru

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    microsoft · edge10 авг. 2017 г.

  • CVE-2016-5018
    39Наблюдать

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application

    КритическаяCVSS 9,1Эксплойта нетEPSS 10 %

    apache · tomcat10 авг. 2017 г.

  • CVE-2016-8745
    35Наблюдать

    A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.R

    ВысокаяCVSS 7,5Эксплойта нетEPSS 16 %

    apache · tomcat10 авг. 2017 г.

  • CVE-2017-8658
    45В плане

    A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scri

    КритическаяCVSS 9,8Эксплойта нетEPSS 20 %

    microsoft · chakracore10 авг. 2017 г.

  • CVE-2017-7675
    33Наблюдать

    The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented dir

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    apache · tomcat10 авг. 2017 г.

  • CVE-2017-11209
    29Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    СредняяCVSS 6,5Эксплойта нетEPSS 11 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11210
    29Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    СредняяCVSS 6,5Эксплойта нетEPSS 11 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11211
    43В плане

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    ВысокаяCVSS 8,8Эксплойта нетEPSS 27 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11220
    39Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    ВысокаяCVSS 8,8Эксплойта нетEPSS 14 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11230
    29Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    СредняяCVSS 6,5Эксплойта нетEPSS 10 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11241
    39Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    ВысокаяCVSS 8,8Эксплойта нетEPSS 14 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11244
    29Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    СредняяCVSS 6,5Эксплойта нетEPSS 10 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11259
    39Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11263
    43В плане

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    ВысокаяCVSS 8,8Эксплойта нетEPSS 26 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-11272
    34Наблюдать

    Adobe Digital Editions 4.5.4 and earlier has a security bypass vulnerability.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %

    adobe · digital editions11 авг. 2017 г.

  • CVE-2017-3106
    42В плане

    Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files.

    ВысокаяCVSS 8,8Proof of conceptEPSS 22 %

    adobe · flash player desktop runtime11 авг. 2017 г.

  • CVE-2017-3117
    41В плане

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-3123
    39Наблюдать

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl

    ВысокаяCVSS 8,8Эксплойта нетEPSS 14 %

    adobe · acrobat11 авг. 2017 г.

  • CVE-2017-6327
    76На этой неделе

    The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an ind

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 35 %

    symantec · message gateway11 авг. 2017 г.

  • CVE-2017-9800
    45В плане

    A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha

    КритическаяCVSS 9,8Эксплойта нетEPSS 18 %

    apache · subversion11 авг. 2017 г.

  • CVE-2017-7546
    57В плане

    PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers

    КритическаяCVSS 9,8Эксплойта нетEPSS 61 %

    postgresql · postgresql16 авг. 2017 г.

  • CVE-2017-11661
    33Наблюдать

    The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application

    ВысокаяCVSS 7,5Proof of conceptEPSS 10 %

    mindwerks · wildmidi17 авг. 2017 г.

  • CVE-2017-12936
    43В плане

    The ReadWMFImage function in coders/wmf.c in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting.

    ВысокаяCVSS 8,8Эксплойта нетEPSS 25 %

    graphicsmagick · graphicsmagick18 авг. 2017 г.

  • CVE-2017-12943
    51В плане

    D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute

    КритическаяCVSS 9,8Proof of conceptEPSS 39 %

    dlink · dir-600 b1 firmware18 авг. 2017 г.

  • CVE-2015-7944
    34Наблюдать

    The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.

    ВысокаяCVSS 7,5Proof of conceptEPSS 14 %

    spi-inc · ganeti18 авг. 2017 г.

  • CVE-2017-10661
    32Наблюдать

    Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list c

    ВысокаяCVSS 7,0Proof of conceptEPSS 13 %

    linux · linux kernel19 авг. 2017 г.

  • CVE-2015-2857
    64На этой неделе

    Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oaut

    КритическаяCVSS 9,8Готовый эксплойтEPSS 84 %

    accellion · file transfer appliance22 авг. 2017 г.

  • CVE-2017-12785
    44В плане

    The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is p

    КритическаяCVSS 9,8Proof of conceptEPSS 15 %

    noviflow · noviware22 авг. 2017 г.

  • CVE-2017-12786
    47В плане

    Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed o

    КритическаяCVSS 9,8Proof of conceptEPSS 25 %

    noviflow · noviware22 авг. 2017 г.

  • CVE-2017-12787
    46В плане

    A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deploye

    КритическаяCVSS 9,8Proof of conceptEPSS 24 %

    noviflow · noviware22 авг. 2017 г.

  • CVE-2017-11610
    61На этой неделе

    The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated us

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 87 %

    supervisord · supervisor23 авг. 2017 г.

  • CVE-2017-12965
    44В плане

    Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.

    КритическаяCVSS 9,8Proof of conceptEPSS 15 %

    apache2triad · apache2triad23 авг. 2017 г.

  • CVE-2017-11317
    94Срочно

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which a

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 84 %

    telerik · ui for asp.net ajax23 авг. 2017 г.

  • CVE-2017-11357
    92Срочно

    Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attacke

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 77 %

    progress · telerik ui for asp.net ajax23 авг. 2017 г.

  • CVE-2017-9506
    45В плане

    The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows

    СредняяCVSS 6,1Proof of conceptEPSS 71 %

    atlassian · oauth23 авг. 2017 г.

  • CVE-2015-7258
    39Наблюдать

    ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by di

    ВысокаяCVSS 8,8Proof of conceptEPSS 12 %

    zte · zxv10 w300 firmware24 авг. 2017 г.

  • CVE-2015-8352
    44В плане

    Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a ..

    КритическаяCVSS 9,8Proof of conceptEPSS 15 %

    zen-cart · zen cart24 авг. 2017 г.

  • CVE-2014-7857
    44В плане

    D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05

    КритическаяCVSS 9,8Эксплойта нетEPSS 15 %

    d-link · dns-322l firmware25 авг. 2017 г.

  • CVE-2014-7858
    44В плане

    The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the u

    КритическаяCVSS 9,8Эксплойта нетEPSS 15 %

    d-link · dnr-326 firmware25 авг. 2017 г.

  • CVE-2014-7859
    45В плане

    Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-32

    КритическаяCVSS 9,8Эксплойта нетEPSS 20 %

    d-link · dns-322l firmware25 авг. 2017 г.

  • CVE-2015-1395
    33Наблюдать

    Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to ar

    ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %

    gnu · patch25 авг. 2017 г.

  • CVE-2015-4181
    33Наблюдать

    Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a ..

    ВысокаяCVSS 7,5Proof of conceptEPSS 11 %

    phpmybackuppro · phpmybackuppro25 авг. 2017 г.

  • CVE-2014-5301
    59В плане

    Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 78 %

    manageengine · servicedesk plus28 авг. 2017 г.