Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: сентябрь 2017 г.

100 записей · 13 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2017-14103
    44В плане

    The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain

    ВысокаяCVSS 8,8Эксплойта нетEPSS 30 %

    graphicsmagick · graphicsmagick1 сент. 2017 г.

  • CVE-2017-3897
    43В плане

    A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee

    КритическаяCVSS 9,8Proof of conceptEPSS 11 %

    mcafee · livesafe1 сент. 2017 г.

  • CVE-2017-14098
    45В плане

    In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, o

    ВысокаяCVSS 7,5Эксплойта нетEPSS 50 %

    digium · asterisk2 сент. 2017 г.

  • CVE-2017-14100
    43В плане

    In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before

    КритическаяCVSS 9,8Эксплойта нетEPSS 14 %

    digium · asterisk2 сент. 2017 г.

  • CVE-2017-14117
    60На этой неделе

    The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenti

    СредняяCVSS 5,9Готовый эксплойтEPSS 8 %

    att · u-verse firmware3 сент. 2017 г.

  • CVE-2017-14135
    46В плане

    enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execut

    КритическаяCVSS 9,8Proof of conceptEPSS 21 %

    dreambox · opendreambox4 сент. 2017 г.

  • CVE-2017-1000083
    46В плане

    backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary com

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 51 %

    gnome · evince5 сент. 2017 г.

  • CVE-2017-1129
    60На этой неделе

    IBM Notes 8.5 and 9.0 is vulnerable to a denial of service.

    СредняяCVSS 6,5Готовый эксплойтEPSS 30 %

    ibm · inotes5 сент. 2017 г.

  • CVE-2017-1130
    60На этой неделе

    IBM Notes 8.5 and 9.0 is vulnerable to a denial of service.

    СредняяCVSS 6,5Готовый эксплойтEPSS 29 %

    ibm · inotes5 сент. 2017 г.

  • CVE-2015-7241
    43В плане

    XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.

    КритическаяCVSS 9,8Proof of conceptEPSS 13 %

    sap · netweaver6 сент. 2017 г.

  • CVE-2017-12794
    31Наблюдать

    In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 d

    СредняяCVSS 6,1Proof of conceptEPSS 23 %

    djangoproject · django7 сент. 2017 г.

  • CVE-2017-14147
    59В плане

    An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a route

    КритическаяCVSS 9,8Proof of conceptEPSS 65 %

    fiberhome · adsl an1020-25 firmware7 сент. 2017 г.

  • CVE-2017-6627
    62На этой неделе

    A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, re

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 6 %

    cisco · ios7 сент. 2017 г.

  • CVE-2015-8351
    47В плане

    PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows

    КритическаяCVSS 9,0Proof of conceptEPSS 37 %

    gwolle guestbook project · gwolle guestbook11 сент. 2017 г.

  • CVE-2017-3133
    27Наблюдать

    A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or command

    СредняяCVSS 6,1Proof of conceptEPSS 10 %

    fortinet · fortios11 сент. 2017 г.

  • CVE-2017-14335
    38Наблюдать

    On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Securi

    ВысокаяCVSS 7,5Proof of conceptEPSS 27 %

    hbgk · hb7024xt firmware12 сент. 2017 г.

  • CVE-2017-1000251
    37Наблюдать

    The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vuln

    ВысокаяCVSS 8,0Proof of conceptEPSS 16 %

    linux · linux kernel12 сент. 2017 г.

  • CVE-2017-0161
    35Наблюдать

    The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a

    ВысокаяCVSS 8,1Эксплойта нетEPSS 11 %

    microsoft · windows 1012 сент. 2017 г.

  • CVE-2017-11764
    49В плане

    Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of th

    ВысокаяCVSS 7,5Proof of conceptEPSS 64 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8567
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel for Mac 2011 when it fails to properly handle objects in memory, aka "Micros

    ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %

    microsoft · excel for mac12 сент. 2017 г.

  • CVE-2017-8630
    37Наблюдать

    Microsoft Office 2016 allows a remote code execution vulnerability when it fails to properly handle objects in memory, aka "Microsoft Office

    ВысокаяCVSS 7,8Эксплойта нетEPSS 21 %

    microsoft · office12 сент. 2017 г.

  • CVE-2017-8631
    36Наблюдать

    A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Mi

    ВысокаяCVSS 7,8Эксплойта нетEPSS 16 %

    microsoft · excel12 сент. 2017 г.

  • CVE-2017-8632
    36Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 20

    ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %

    microsoft · excel12 сент. 2017 г.

  • CVE-2017-8660
    38Наблюдать

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8676
    17Наблюдать

    The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012

    НизкаяCVSS 3,3Эксплойта нетEPSS 14 %

    microsoft · live meeting12 сент. 2017 г.

  • CVE-2017-8682
    50В плане

    Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.

    ВысокаяCVSS 8,8Proof of conceptEPSS 49 %

    microsoft · office 200712 сент. 2017 г.

  • CVE-2017-8683
    29Наблюдать

    Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.

    СредняяCVSS 5,5Proof of conceptEPSS 22 %

    microsoft · windows 1012 сент. 2017 г.

  • CVE-2017-8686
    47В плане

    The Windows Server DHCP service in Windows Server 2012 Gold and R2, and Windows Server 2016 allows an attacker to either run arbitrary code

    КритическаяCVSS 9,8Эксплойта нетEPSS 27 %

    microsoft · windows server 201212 сент. 2017 г.

  • CVE-2017-8692
    35Наблюдать

    The Windows Uniscribe component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and

    ВысокаяCVSS 7,5Эксплойта нетEPSS 16 %

    microsoft · windows 1012 сент. 2017 г.

  • CVE-2017-8696
    34Наблюдать

    Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · live meeting12 сент. 2017 г.

  • CVE-2017-8699
    34Наблюдать

    Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window

    ВысокаяCVSS 7,0Эксплойта нетEPSS 21 %

    microsoft · windows 1012 сент. 2017 г.

  • CVE-2017-8710
    25Наблюдать

    The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbit

    СредняяCVSS 5,5Эксплойта нетEPSS 10 %

    microsoft · windows 712 сент. 2017 г.

  • CVE-2017-8725
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Publisher 2007 Service Pack 3 and Microsoft Publisher 2010 Service Pack 2 when the

    ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %

    microsoft · publisher12 сент. 2017 г.

  • CVE-2017-8728
    36Наблюдать

    Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, an

    ВысокаяCVSS 7,5Эксплойта нетEPSS 21 %

    microsoft · windows 8.112 сент. 2017 г.

  • CVE-2017-8729
    52В плане

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way

    ВысокаяCVSS 7,5Proof of conceptEPSS 72 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8731
    45В плане

    Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curre

    ВысокаяCVSS 7,5Proof of conceptEPSS 51 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8734
    46В плане

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the c

    ВысокаяCVSS 7,5Proof of conceptEPSS 52 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8737
    36Наблюдать

    Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, an

    ВысокаяCVSS 7,5Эксплойта нетEPSS 21 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8740
    52В плане

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way

    ВысокаяCVSS 7,5Proof of conceptEPSS 72 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8741
    34Наблюдать

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8742
    38Наблюдать

    A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, Microsof

    ВысокаяCVSS 7,8Эксплойта нетEPSS 22 %

    microsoft · office compatibility pack12 сент. 2017 г.

  • CVE-2017-8743
    38Наблюдать

    A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016, and Office Online Se

    ВысокаяCVSS 7,8Эксплойта нетEPSS 22 %

    microsoft · office online server12 сент. 2017 г.

  • CVE-2017-8744
    36Наблюдать

    A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Mi

    ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %

    microsoft · office12 сент. 2017 г.

  • CVE-2017-8747
    33Наблюдать

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    microsoft · internet explorer12 сент. 2017 г.

  • CVE-2017-8748
    34Наблюдать

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Micros

    ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8749
    33Наблюдать

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    microsoft · internet explorer12 сент. 2017 г.

  • CVE-2017-8751
    45В плане

    Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way tha

    ВысокаяCVSS 7,5Proof of conceptEPSS 50 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8755
    51В плане

    Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context

    ВысокаяCVSS 7,5Proof of conceptEPSS 71 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8757
    35Наблюдать

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the c

    ВысокаяCVSS 7,5Эксплойта нетEPSS 16 %

    microsoft · edge12 сент. 2017 г.

  • CVE-2017-8759
    88Срочно

    Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious docume

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 88 %

    microsoft · .net framework12 сент. 2017 г.

  • CVE-2017-1002000
    47В плане

    Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch

    КритическаяCVSS 9,8Proof of conceptEPSS 27 %

    mobile-friendly-app-builder-by-easytouch project · mobile-friendly-app-builder-by-easytouch14 сент. 2017 г.

  • CVE-2017-1002001
    42В плане

    Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://w

    КритическаяCVSS 9,8Proof of conceptEPSS 11 %

    mobile-app-builder-by-wappress project · mobile-app-builder-by-wappress14 сент. 2017 г.

  • CVE-2017-1002002
    43В плане

    Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    webapp-builder project · webapp-builder14 сент. 2017 г.

  • CVE-2017-1002003
    43В плане

    Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software fr

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    wp2android-turn-wp-site-into-android-app project · wp2android-turn-wp-site-into-android-app14 сент. 2017 г.

  • CVE-2017-1002008
    44В плане

    Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    membership simplified project · membership simplified14 сент. 2017 г.

  • CVE-2017-13067
    60На этой неделе

    QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and

    КритическаяCVSS 9,8Готовый эксплойтEPSS 16 %

    qnap · qts14 сент. 2017 г.

  • CVE-2017-0781
    42В плане

    A remote code execution vulnerability in the Android system (bluetooth).

    ВысокаяCVSS 8,8Proof of conceptEPSS 22 %

    google · android14 сент. 2017 г.

  • CVE-2017-0785
    30Наблюдать

    A information disclosure vulnerability in the Android system (bluetooth).

    СредняяCVSS 6,5Proof of conceptEPSS 12 %

    google · android14 сент. 2017 г.

  • CVE-2017-9805
    92Срочно

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea

    ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 99 %

    apache · struts15 сент. 2017 г.

  • CVE-2014-9463
    39Наблюдать

    functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer

    ВысокаяCVSS 8,8Proof of conceptEPSS 14 %

    vbseo · vbseo15 сент. 2017 г.

  • CVE-2017-14502
    31Наблюдать

    read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, lead

    ВысокаяCVSS 7,5Эксплойта нетEPSS 3 %

    libarchive · libarchive17 сент. 2017 г.

  • CVE-2017-14243
    43В плане

    An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access

    КритическаяCVSS 9,8Proof of conceptEPSS 14 %

    utstar · wa3002g4 firmware17 сент. 2017 г.

  • CVE-2017-14244
    44В плане

    An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directl

    КритическаяCVSS 9,8Proof of conceptEPSS 17 %

    iball · ib-wra150n firmware17 сент. 2017 г.

  • CVE-2017-9798
    60На этой неделе

    Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 94 %

    apache · http server18 сент. 2017 г.

  • CVE-2017-12615
    92Срочно

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

    ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 99 %

    apache · tomcat19 сент. 2017 г.

  • CVE-2014-9611
    43В плане

    Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmi

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    netsweeper · netsweeper19 сент. 2017 г.

  • CVE-2014-9618
    61На этой неделе

    The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass aut

    КритическаяCVSS 9,8Proof of conceptEPSS 72 %

    netsweeper · netsweeper19 сент. 2017 г.

  • CVE-2017-14143
    62На этой неделе

    The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote at

    КритическаяCVSS 9,8Готовый эксплойтEPSS 77 %

    kaltura · kaltura server19 сент. 2017 г.

  • CVE-2017-10784
    40В плане

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers t

    ВысокаяCVSS 8,8Эксплойта нетEPSS 16 %

    ruby-lang · ruby19 сент. 2017 г.

  • CVE-2017-6315
    44В плане

    Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx.

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    sophos · astaro security gateway firmware19 сент. 2017 г.

  • CVE-2017-12616
    51В плане

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code

    ВысокаяCVSS 7,5Эксплойта нетEPSS 70 %

    apache · tomcat19 сент. 2017 г.

  • CVE-2014-8684
    61На этой неделе

    CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and

    КритическаяCVSS 9,8Готовый эксплойтEPSS 71 %

    codeigniter · codeigniter19 сент. 2017 г.

  • CVE-2014-8686
    60На этой неделе

    CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption sch

    КритическаяCVSS 9,8Готовый эксплойтEPSS 37 %

    codeigniter · codeigniter19 сент. 2017 г.

  • CVE-2017-8770
    33Наблюдать

    There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device vi

    ВысокаяCVSS 7,5Proof of conceptEPSS 10 %

    twsz · wifi repeater firmware20 сент. 2017 г.

  • CVE-2015-4074
    47В плане

    Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a

    ВысокаяCVSS 7,5Proof of conceptEPSS 56 %

    helpdesk pro project · helpdesk pro20 сент. 2017 г.

  • CVE-2017-7924
    60На этой неделе

    An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB,

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 22 %

    rockwellautomation · 1763-l16bwa firmware20 сент. 2017 г.

  • CVE-2017-12611
    65На этой неделе

    In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string lite

    КритическаяCVSS 9,8Proof of conceptEPSS 87 %

    apache · struts20 сент. 2017 г.

  • CVE-2015-2826
    25Наблюдать

    WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.

    СредняяCVSS 5,3Proof of conceptEPSS 12 %

    simple ads manager project · simple ads manager20 сент. 2017 г.

  • CVE-2015-1187
    94Срочно

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.c

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 82 %

    trendnet · tew-731br firmware21 сент. 2017 г.

  • CVE-2017-12929
    38Наблюдать

    Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary

    ВысокаяCVSS 8,8Proof of conceptEPSS 10 %

    tecnovision · dlx spot player421 сент. 2017 г.

  • CVE-2017-11395
    39Наблюдать

    Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers wi

    ВысокаяCVSS 8,8Эксплойта нетEPSS 14 %

    trendmicro · smart protection server22 сент. 2017 г.

  • CVE-2017-14078
    54В плане

    SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbi

    КритическаяCVSS 9,8Эксплойта нетEPSS 50 %

    trendmicro · mobile security22 сент. 2017 г.

  • CVE-2017-14079
    38Наблюдать

    Unrestricted file uploads in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrar

    ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %

    trendmicro · mobile security22 сент. 2017 г.

  • CVE-2017-14081
    40В плане

    Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to ex

    ВысокаяCVSS 8,8Эксплойта нетEPSS 16 %

    trendmicro · mobile security22 сент. 2017 г.

  • CVE-2017-14706
    60На этой неделе

    DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /w

    КритическаяCVSS 9,8Готовый эксплойтEPSS 28 %

    denyall · i-suite22 сент. 2017 г.

  • CVE-2017-14627
    40В плане

    Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INF

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 19 %

    cyberlink · labelprint23 сент. 2017 г.

  • CVE-2017-14719
    34Наблюдать

    Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen

    ВысокаяCVSS 7,5Proof of conceptEPSS 12 %

    wordpress · wordpress23 сент. 2017 г.

  • CVE-2015-4667
    42В плане

    Multiple hardcoded credentials in Xsuite 2.x.

    КритическаяCVSS 9,8Proof of conceptEPSS 11 %

    xceedium · xsuite25 сент. 2017 г.

  • CVE-2015-8249
    61На этой неделе

    The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary fil

    КритическаяCVSS 9,8Готовый эксплойтEPSS 73 %

    manageengine · desktop central27 сент. 2017 г.

  • CVE-2017-14849
    46В плане

    Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the p

    ВысокаяCVSS 7,5Proof of conceptEPSS 54 %

    nodejs · node.js27 сент. 2017 г.

  • CVE-2017-12231
    62На этой неделе

    A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unaut

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 7 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-12232
    57В плане

    A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.

    СредняяCVSS 6,5KEVГотовый эксплойтEPSS 2 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-12233
    62На этой неделе

    Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 7 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-12234
    62На этой неделе

    Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 7 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-12235
    62На этой неделе

    A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could al

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 7 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-12237
    62На этой неделе

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 7 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-12238
    57В плане

    A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could

    СредняяCVSS 6,5KEVГотовый эксплойтEPSS 2 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-12240
    73На этой неделе

    The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticat

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 13 %

    cisco · ios28 сент. 2017 г.

  • CVE-2017-14867
    46В плане

    Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to su

    ВысокаяCVSS 8,8Эксплойта нетEPSS 36 %

    git-scm · git28 сент. 2017 г.

  • CVE-2017-14942
    57В плане

    Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct reques

    КритическаяCVSS 9,8Proof of conceptEPSS 60 %

    intelbras · wrn 150 firmware29 сент. 2017 г.