По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2018 г.
113 записей · 4 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
41В плане | CVE-2018-6008Proof of concept | Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.joomlatag · jtag members directory · CWE-200 | Высокая7,5 | — | 36,8 % | 29 янв. 2018 г. |
99Срочно | CVE-2017-1000353Готовый эксплойт | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.jenkins · jenkins · CWE-502 | Критическая9,8 | KEV | 99,6 % | 29 янв. 2018 г. |
39Наблюдать | CVE-2018-6383Proof of concept | Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phamonstra · monstra · CWE-184 | Высокая8,8 | — | 13,4 % | 29 янв. 2018 г. |
66На этой неделе | CVE-2018-0101Proof of concept | A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an ucisco · adaptive security appliance software · CWE-415 | Критическая10,0 | — | 86,7 % | 29 янв. 2018 г. |
34Наблюдать | CVE-2018-6397Proof of concept | Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.joomlacalendars · picture calendar · CWE-22 | Высокая7,5 | — | 11,9 % | 30 янв. 2018 г. |
41В плане | CVE-2018-6377Эксплойта нет | In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, joomla · joomla\! · CWE-79 | Средняя6,1 | — | 56,5 % | 30 янв. 2018 г. |
45В плане | CVE-2016-6598Proof of concept | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010.bmc · track-it\! · CWE-284 | Критическая9,8 | — | 19,2 % | 30 янв. 2018 г. |
43В плане | CVE-2016-6599Proof of concept | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010.bmc · track-it\! · CWE-255 | Критическая9,8 | — | 12,3 % | 30 янв. 2018 г. |
40В плане | CVE-2018-6407Proof of concept | An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices.conceptronic · cipcamptiwl firmware · CWE-20 | Высокая7,5 | — | 32,2 % | 30 янв. 2018 г. |
40В плане | CVE-2018-1000001Готовый эксплойт | In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffergnu · glibc · CWE-787 | Высокая7,8 | — | 13,3 % | 31 янв. 2018 г. |
33Наблюдать | CVE-2018-6460Proof of concept | Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895.anchorfree · hotspot shield · CWE-200 | Высокая7,5 | — | 10,9 % | 31 янв. 2018 г. |
35Наблюдать | CVE-2014-1632Proof of concept | htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.eventum project · eventum · CWE-275 | Высокая8,1 | — | 10,4 % | 31 янв. 2018 г. |
45В плане | CVE-2018-5701Proof of concept | In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not valiiolo · system shield · CWE-119 | Критическая9,8 | — | 18,4 % | 31 янв. 2018 г. |
- CVE-2018-600841В плане
Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.
ВысокаяCVSS 7,5Proof of conceptEPSS 36 %joomlatag · jtag members directory29 янв. 2018 г.
- CVE-2017-100035399Срочно
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %jenkins · jenkins29 янв. 2018 г.
- CVE-2018-638339Наблюдать
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .pha
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %monstra · monstra29 янв. 2018 г.
- CVE-2018-010166На этой неделе
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an u
КритическаяCVSS 10,0Proof of conceptEPSS 86 %cisco · adaptive security appliance software29 янв. 2018 г.
- CVE-2018-639734Наблюдать
Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %joomlacalendars · picture calendar30 янв. 2018 г.
- CVE-2018-637741В плане
In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio,
СредняяCVSS 6,1Эксплойта нетEPSS 56 %joomla · joomla\!30 янв. 2018 г.
- CVE-2016-659845В плане
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010.
КритическаяCVSS 9,8Proof of conceptEPSS 19 %bmc · track-it\!30 янв. 2018 г.
- CVE-2016-659943В плане
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010.
КритическаяCVSS 9,8Proof of conceptEPSS 12 %bmc · track-it\!30 янв. 2018 г.
- CVE-2018-640740В плане
An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices.
ВысокаяCVSS 7,5Proof of conceptEPSS 32 %conceptronic · cipcamptiwl firmware30 янв. 2018 г.
- CVE-2018-100000140В плане
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer
ВысокаяCVSS 7,8Готовый эксплойтEPSS 13 %gnu · glibc31 янв. 2018 г.
- CVE-2018-646033Наблюдать
Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895.
ВысокаяCVSS 7,5Proof of conceptEPSS 10 %anchorfree · hotspot shield31 янв. 2018 г.
- CVE-2014-163235Наблюдать
htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
ВысокаяCVSS 8,1Proof of conceptEPSS 10 %eventum project · eventum31 янв. 2018 г.
- CVE-2018-570145В плане
In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not vali
КритическаяCVSS 9,8Proof of conceptEPSS 18 %iolo · system shield31 янв. 2018 г.