По дате публикации
Эксплуатируемые и новые серьёзные CVE: март 2018 г.
114 записей · 22 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
65На этой неделе | CVE-2018-2380Готовый эксплойт | SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thusap · customer relationship management · CWE-22 | Средняя6,6 | KEV | 28,9 % | 1 мар. 2018 г. |
60На этой неделе | CVE-2018-7573Готовый эксплойт | An issue was discovered in FTPShell Client 6.7.ftpshell · ftpshell client · CWE-119 | Критическая9,8 | — | 69,2 % | 1 мар. 2018 г. |
65На этой неделе | CVE-2018-7584Proof of concept | In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while paphp · php · CWE-119 | Критическая9,8 | — | 87,3 % | 1 мар. 2018 г. |
33Наблюдать | CVE-2017-14461Эксплойта нет | A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensidovecot · dovecot · CWE-125 | Высокая7,1 | — | 16,6 % | 2 мар. 2018 г. |
39Наблюдать | CVE-2018-1058Proof of concept | A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.postgresql · postgresql · CWE-20 | Высокая8,8 | — | 13,0 % | 2 мар. 2018 г. |
41В плане | CVE-2018-7583Proof of concept | Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.advantig · dualdesk · CWE-20 | Высокая7,5 | — | 38,0 % | 3 мар. 2018 г. |
35Наблюдать | CVE-2018-7662Proof of concept | Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmcouchcms · couch · CWE-200 | Средняя5,3 | — | 47,0 % | 4 мар. 2018 г. |
60На этой неделе | CVE-2018-7665Готовый эксплойт | An issue was discovered in ClipBucket before 4.0.0 Release 4902.clip-bucket · clipbucket · CWE-434 | Критическая9,8 | — | 15,8 % | 5 мар. 2018 г. |
60На этой неделе | CVE-2018-1000115Готовый эксплойт | Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDPmemcached · memcached · CWE-400 | Высокая7,5 | — | 88,1 % | 5 мар. 2018 г. |
34Наблюдать | CVE-2018-0491Proof of concept | A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10.torproject · tor · CWE-416 | Высокая7,5 | — | 14,7 % | 5 мар. 2018 г. |
60На этой неделе | CVE-2017-17428Готовый эксплойт | Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by levecavium · nitrox ssl sdk · CWE-327 | Средняя5,9 | — | 14,5 % | 5 мар. 2018 г. |
43В плане | CVE-2015-5377Proof of concept | Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.elastic · elasticsearch · CWE-74 | Критическая9,8 | — | 14,3 % | 6 мар. 2018 г. |
98Срочно | CVE-2018-6530Готовый эксплойт | OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previousdlink · dir-860l firmware · CWE-78 | Критическая9,8 | KEV | 96,6 % | 6 мар. 2018 г. |
39Наблюдать | CVE-2018-7182Proof of concept | The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via ntp · ntp · CWE-125 | Высокая7,5 | — | 28,8 % | 6 мар. 2018 г. |
55В плане | CVE-2018-7739Proof of concept | antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters,antsle · antman · CWE-20 | Критическая9,8 | — | 53,2 % | 6 мар. 2018 г. |
34Наблюдать | CVE-2018-7745Proof of concept | An issue was discovered in Western Bridge Cobub Razor 0.7.2.cobub · razor · CWE-287 | Высокая7,5 | — | 12,0 % | 7 мар. 2018 г. |
46В плане | CVE-2017-15367Proof of concept | Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula databasebacula · bacula-web · CWE-89 | Критическая9,8 | — | 23,0 % | 7 мар. 2018 г. |
74На этой неделе | CVE-2018-0147Готовый эксплойт | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthecisco · secure access control system · CWE-20 | Критическая9,8 | KEV | 18,2 % | 8 мар. 2018 г. |
45В плане | CVE-2018-1216Эксплойта нет | A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabdell · emc solutions enabler virtual appliance · CWE-798 | Критическая9,8 | — | 21,3 % | 8 мар. 2018 г. |
42В плане | CVE-2018-7183Эксплойта нет | Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leverntp · ntp · CWE-787 | Критическая9,8 | — | 10,2 % | 8 мар. 2018 г. |
63На этой неделе | CVE-2018-7890Готовый эксплойт | A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640).zohocorp · manageengine applications manager · CWE-78 | Критическая9,8 | — | 78,8 % | 8 мар. 2018 г. |
41В плане | CVE-2018-7582Proof of concept | WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.weblogexpert · weblog expert · CWE-770 | Высокая7,5 | — | 36,4 % | 9 мар. 2018 г. |
34Наблюдать | CVE-2018-8056Proof of concept | Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/manage/channel/addchancobub · razor · CWE-200 | Высокая7,5 | — | 12,7 % | 11 мар. 2018 г. |
46В плане | CVE-2018-8057Proof of concept | A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/westernbridgegroup · razor · CWE-89 | Критическая9,8 | — | 21,8 % | 11 мар. 2018 г. |
60На этой неделе | CVE-2018-8065Готовый эксплойт | An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24.flexense · syncbreeze · CWE-20 | Высокая7,5 | — | 75,8 % | 12 мар. 2018 г. |
33Наблюдать | CVE-2017-2619Proof of concept | Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the servsamba · samba · CWE-362 | Высокая7,5 | — | 11,1 % | 12 мар. 2018 г. |
44В плане | CVE-2018-1323Proof of concept | The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it toapache · tomcat jk connector · CWE-22 | Высокая7,5 | — | 46,3 % | 12 мар. 2018 г. |
40В плане | CVE-2018-1000094Готовый эксплойт | CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admicmsmadesimple · cms made simple · CWE-434 | Высокая7,2 | — | 38,8 % | 12 мар. 2018 г. |
38Наблюдать | CVE-2018-1057Эксплойта нет | On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDsamba · samba · CWE-863 | Высокая8,8 | — | 10,0 % | 13 мар. 2018 г. |
42В плане | CVE-2017-1002101Proof of concept | In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with kubernetes · kubernetes · CWE-59 | Критическая9,6 | — | 12,9 % | 13 мар. 2018 г. |
47В плане | CVE-2018-7750Proof of concept | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.xparamiko · paramiko · CWE-287 | Критическая9,8 | — | 27,1 % | 13 мар. 2018 г. |
53В плане | CVE-2018-8096Proof of concept | Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationedatalust · seq · CWE-287 | Критическая9,8 | — | 48,1 % | 13 мар. 2018 г. |
31Наблюдать | CVE-2018-1000129Proof of concept | An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript ijolokia · jolokia · CWE-79 | Средняя6,1 | — | 24,6 % | 14 мар. 2018 г. |
54В плане | CVE-2018-1000130Proof of concept | A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java cjolokia · webarchive agent · CWE-74 | Высокая8,1 | — | 73,9 % | 14 мар. 2018 г. |
45В плане | CVE-2018-5782Proof of concept | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and mitel · connect onsite · CWE-94 | Критическая9,8 | — | 18,7 % | 14 мар. 2018 г. |
35Наблюдать | CVE-2018-0872Эксплойта нет | ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, dumicrosoft · edge · CWE-787 | Высокая7,5 | — | 15,7 % | 14 мар. 2018 г. |
35Наблюдать | CVE-2018-0873Эксплойта нет | ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to hmicrosoft · edge · CWE-787 | Высокая7,5 | — | 15,4 % | 14 мар. 2018 г. |
35Наблюдать | CVE-2018-0874Эксплойта нет | ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, dumicrosoft · edge · CWE-787 | Высокая7,5 | — | 15,7 % | 14 мар. 2018 г. |
35Наблюдать | CVE-2018-0876Эксплойта нет | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting enmicrosoft · edge · CWE-787 | Высокая7,5 | — | 15,7 % | 14 мар. 2018 г. |
18Наблюдать | CVE-2018-0878Proof of concept | Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2microsoft · windows 10 · CWE-611 | Низкая3,1 | — | 21,1 % | 14 мар. 2018 г. |
34Наблюдать | CVE-2018-0883Эксплойта нет | Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10microsoft · windows 10 | Высокая7,5 | — | 14,5 % | 14 мар. 2018 г. |
53В плане | CVE-2018-0886Proof of concept | The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and microsoft · windows 10 · CWE-287 | Высокая7,0 | — | 81,9 % | 14 мар. 2018 г. |
35Наблюдать | CVE-2018-0889Эксплойта нет | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting enmicrosoft · internet explorer · CWE-787 | Высокая7,5 | — | 15,7 % | 14 мар. 2018 г. |
21Наблюдать | CVE-2018-0891Proof of concept | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Servermicrosoft · internet explorer · CWE-401 | Средняя4,3 | — | 14,1 % | 14 мар. 2018 г. |
38Наблюдать | CVE-2018-0893Эксплойта нет | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting enmicrosoft · edge · CWE-787 | Высокая7,5 | — | 26,6 % | 14 мар. 2018 г. |
36Наблюдать | CVE-2018-0903Эксплойта нет | Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code execmicrosoft · access | Высокая7,8 | — | 15,9 % | 14 мар. 2018 г. |
16Наблюдать | CVE-2018-0919Эксплойта нет | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2microsoft · office · CWE-125 | Низкая3,3 | — | 11,6 % | 14 мар. 2018 г. |
36Наблюдать | CVE-2018-0922Эксплойта нет | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibilmicrosoft · office · CWE-787 | Высокая7,8 | — | 17,9 % | 14 мар. 2018 г. |
33Наблюдать | CVE-2018-0925Эксплойта нет | ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory microsoft · chakracore · CWE-787 | Высокая7,5 | — | 11,4 % | 14 мар. 2018 г. |
33Наблюдать | CVE-2018-0930Эксплойта нет | ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles objemicrosoft · edge · CWE-787 | Высокая7,5 | — | 11,5 % | 14 мар. 2018 г. |
33Наблюдать | CVE-2018-0931Эксплойта нет | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakrmicrosoft · edge · CWE-787 | Высокая7,5 | — | 11,4 % | 14 мар. 2018 г. |
50В плане | CVE-2018-0933Proof of concept | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakrmicrosoft · edge · CWE-787 | Высокая7,5 | — | 66,3 % | 14 мар. 2018 г. |
50В плане | CVE-2018-0934Proof of concept | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakrmicrosoft · edge · CWE-755 | Высокая7,5 | — | 66,2 % | 14 мар. 2018 г. |
47В плане | CVE-2018-0935Proof of concept | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wimicrosoft · internet explorer · CWE-416 | Высокая7,5 | — | 55,5 % | 14 мар. 2018 г. |
35Наблюдать | CVE-2018-0936Эксплойта нет | ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka microsoft · edge · CWE-787 | Высокая7,5 | — | 15,4 % | 14 мар. 2018 г. |
35Наблюдать | CVE-2018-0937Эксплойта нет | ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memmicrosoft · edge · CWE-787 | Высокая7,5 | — | 15,4 % | 14 мар. 2018 г. |
26Наблюдать | CVE-2018-0941Эксплойта нет | Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vumicrosoft · exchange server | Средняя5,5 | — | 12,4 % | 14 мар. 2018 г. |
42В плане | CVE-2018-1000120Эксплойта нет | A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of sedebian · debian linux · CWE-787 | Критическая9,8 | — | 11,6 % | 14 мар. 2018 г. |
60На этой неделе | CVE-2018-6328Готовый эксплойт | It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allokaseya · unitrends backup · CWE-287 | Критическая9,8 | — | 64,3 % | 14 мар. 2018 г. |
60На этой неделе | CVE-2018-6329Готовый эксплойт | It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing aunitrends · backup · CWE-89 | Критическая9,8 | — | 61,2 % | 14 мар. 2018 г. |
40В плане | CVE-2018-7702Proof of concept | SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arsecurenvoy · securmail · CWE-862 | Критическая9,1 | — | 13,9 % | 14 мар. 2018 г. |
57В плане | CVE-2018-7756Proof of concept | RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which aldewesoft · dewesoft · CWE-94 | Критическая9,8 | — | 60,7 % | 14 мар. 2018 г. |
43В плане | CVE-2018-8045Proof of concept | In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Userjoomla · joomla\! · CWE-89 | Высокая8,8 | — | 28,2 % | 14 мар. 2018 г. |
39Наблюдать | CVE-2018-8715Proof of concept | The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c.embedthis · appweb · CWE-287 | Высокая8,1 | — | 22,7 % | 14 мар. 2018 г. |
42В плане | CVE-2018-6223Proof of concept | A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to mantrendmicro · email encryption gateway · CWE-306 | Критическая9,8 | — | 10,0 % | 15 мар. 2018 г. |
42В плане | CVE-2018-6228Proof of concept | A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands totrendmicro · email encryption gateway · CWE-89 | Критическая9,8 | — | 10,2 % | 15 мар. 2018 г. |
42В плане | CVE-2018-6229Proof of concept | A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commatrendmicro · email encryption gateway · CWE-89 | Критическая9,8 | — | 10,2 % | 15 мар. 2018 г. |
39Наблюдать | CVE-2018-8770Proof of concept | Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.cobub · razor · CWE-200 | Средняя5,3 | — | 59,2 % | 18 мар. 2018 г. |
49В плане | CVE-2018-7422Proof of concept | A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary filsiteeditor · site editor · CWE-22 | Высокая7,5 | — | 62,2 % | 19 мар. 2018 г. |
35Наблюдать | CVE-2018-1218Proof of concept | In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes dell · emc networker · CWE-119 | Высокая7,5 | — | 15,7 % | 19 мар. 2018 г. |
35Наблюдать | CVE-2014-2674Proof of concept | Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary ajax-pagination project · ajax-pagination · CWE-22 | Высокая7,5 | — | 15,1 % | 19 мар. 2018 г. |
87Срочно | CVE-2018-7445Готовый эксплойт | A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.mikrotik · routeros · CWE-119 | Критическая9,8 | KEV | 60,8 % | 19 мар. 2018 г. |
58В плане | CVE-2017-17215Proof of concept | Huawei HG532 with some customized versions has a remote code execution vulnerability.huawei · hg532 firmware · CWE-20 | Высокая8,8 | — | 78,2 % | 20 мар. 2018 г. |
43В плане | CVE-2018-8088Эксплойта нет | org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restricqos · slf4j | Критическая9,8 | — | 14,7 % | 20 мар. 2018 г. |
33Наблюдать | CVE-2018-1321Proof of concept | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1apache · syncope · CWE-20 | Высокая7,2 | — | 17,5 % | 20 мар. 2018 г. |
25Наблюдать | CVE-2018-1322Proof of concept | An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x andapache · syncope · CWE-200 | Средняя4,9 | — | 19,9 % | 20 мар. 2018 г. |
48В плане | CVE-2018-8828Эксплойта нет | A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2.kamailio · kamailio · CWE-193 | Критическая9,8 | — | 30,4 % | 20 мар. 2018 г. |
66На этой неделе | CVE-2018-1207Proof of concept | Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code.dell · emc idrac7 · CWE-94 | Критическая9,8 | — | 90,0 % | 23 мар. 2018 г. |
60На этой неделе | CVE-2017-17736Proof of concept | Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/instakentico · xperience · CWE-425 | Критическая9,8 | — | 68,4 % | 23 мар. 2018 г. |
44В плане | CVE-2018-7719Proof of concept | Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.acrolinx · acrolinx server · CWE-22 | Высокая7,5 | — | 46,8 % | 25 мар. 2018 г. |
33Наблюдать | CVE-2018-8947Proof of concept | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attacklaravel log viewer project · laravel log viewer · CWE-312 | Высокая7,5 | — | 11,0 % | 25 мар. 2018 г. |
35Наблюдать | CVE-2017-15710Эксплойта нет | In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the apache · http server · CWE-787 | Высокая7,5 | — | 17,0 % | 26 мар. 2018 г. |
58В плане | CVE-2017-15715Proof of concept | In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, raapache · http server · CWE-20 | Высокая8,1 | — | 85,4 % | 26 мар. 2018 г. |
27Наблюдать | CVE-2018-1301Эксплойта нет | A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size liapache · http server · CWE-119 | Средняя5,9 | — | 14,9 % | 26 мар. 2018 г. |
27Наблюдать | CVE-2018-1302Эксплойта нет | When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer poapache · http server · CWE-476 | Средняя5,9 | — | 12,8 % | 26 мар. 2018 г. |
51В плане | CVE-2018-1303Эксплойта нет | A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while apache · http server · CWE-125 | Высокая7,5 | — | 69,8 % | 26 мар. 2018 г. |
44В плане | CVE-2018-1312Эксплойта нет | In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not coapache · http server · CWE-287 | Критическая9,8 | — | 15,7 % | 26 мар. 2018 г. |
27Наблюдать | CVE-2018-1189Proof of concept | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affedell · emc isilon · CWE-79 | Средняя4,8 | — | 27,7 % | 26 мар. 2018 г. |
42В плане | CVE-2018-7658Proof of concept | NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by ssoftros · network time system · CWE-20 | Высокая7,5 | — | 38,5 % | 26 мар. 2018 г. |
47В плане | CVE-2018-9032Proof of concept | An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmwardlink · dir-850l firmware · CWE-287 | Критическая9,8 | — | 27,6 % | 26 мар. 2018 г. |
60На этой неделе | CVE-2017-12319Готовый эксплойт | A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow acisco · ios · CWE-20 | Средняя5,9 | KEV | 5,2 % | 27 мар. 2018 г. |
57В плане | CVE-2018-7700Proof of concept | DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specifydedecms · dedecms · CWE-352 | Высокая8,8 | — | 74,1 % | 27 мар. 2018 г. |
63На этой неделе | CVE-2018-6882Готовый эксплойт | Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 synacor · zimbra collaboration suite · CWE-79 | Средняя6,1 | KEV | 29,7 % | 27 мар. 2018 г. |
32Наблюдать | CVE-2018-0739Эксплойта нет | Constructed ASN.1 types with a recursive definition could exceed the stackopenssl · openssl · CWE-674 | Средняя6,5 | — | 18,5 % | 27 мар. 2018 г. |
54В плане | CVE-2018-8823Proof of concept | modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 throprestashop · prestashop · CWE-94 | Критическая9,8 | — | 50,3 % | 27 мар. 2018 г. |
73На этой неделе | CVE-2018-0151Готовый эксплойт | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, recisco · ios xe · CWE-119 | Критическая9,8 | KEV | 14,1 % | 28 мар. 2018 г. |
62На этой неделе | CVE-2018-0154Готовый эксплойт | A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unacisco · ios · CWE-399 | Высокая7,5 | KEV | 7,0 % | 28 мар. 2018 г. |
66На этой неделе | CVE-2018-0155Готовый эксплойт | A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catacisco · ios · CWE-388 | Высокая8,6 | KEV | 7,7 % | 28 мар. 2018 г. |
63На этой неделе | CVE-2018-0156Готовый эксплойт | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attackercisco · ios · CWE-399 | Высокая7,5 | KEV | 9,3 % | 28 мар. 2018 г. |
66На этой неделе | CVE-2018-0158Готовый эксплойт | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthecisco · ios · CWE-20 | Высокая8,6 | KEV | 7,1 % | 28 мар. 2018 г. |
- CVE-2018-238065На этой неделе
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thu
СредняяCVSS 6,6KEVГотовый эксплойтEPSS 28 %sap · customer relationship management1 мар. 2018 г.
- CVE-2018-757360На этой неделе
An issue was discovered in FTPShell Client 6.7.
КритическаяCVSS 9,8Готовый эксплойтEPSS 69 %ftpshell · ftpshell client1 мар. 2018 г.
- CVE-2018-758465На этой неделе
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while pa
КритическаяCVSS 9,8Proof of conceptEPSS 87 %php · php1 мар. 2018 г.
- CVE-2017-1446133Наблюдать
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensi
ВысокаяCVSS 7,1Эксплойта нетEPSS 16 %dovecot · dovecot2 мар. 2018 г.
- CVE-2018-105839Наблюдать
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.
ВысокаяCVSS 8,8Proof of conceptEPSS 13 %postgresql · postgresql2 мар. 2018 г.
- CVE-2018-758341В плане
Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.
ВысокаяCVSS 7,5Proof of conceptEPSS 38 %advantig · dualdesk3 мар. 2018 г.
- CVE-2018-766235Наблюдать
Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpm
СредняяCVSS 5,3Proof of conceptEPSS 47 %couchcms · couch4 мар. 2018 г.
- CVE-2018-766560На этой неделе
An issue was discovered in ClipBucket before 4.0.0 Release 4902.
КритическаяCVSS 9,8Готовый эксплойтEPSS 15 %clip-bucket · clipbucket5 мар. 2018 г.
- CVE-2018-100011560На этой неделе
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP
ВысокаяCVSS 7,5Готовый эксплойтEPSS 88 %memcached · memcached5 мар. 2018 г.
- CVE-2018-049134Наблюдать
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10.
ВысокаяCVSS 7,5Proof of conceptEPSS 14 %torproject · tor5 мар. 2018 г.
- CVE-2017-1742860На этой неделе
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leve
СредняяCVSS 5,9Готовый эксплойтEPSS 14 %cavium · nitrox ssl sdk5 мар. 2018 г.
- CVE-2015-537743В плане
Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.
КритическаяCVSS 9,8Proof of conceptEPSS 14 %elastic · elasticsearch6 мар. 2018 г.
- CVE-2018-653098Срочно
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 96 %dlink · dir-860l firmware6 мар. 2018 г.
- CVE-2018-718239Наблюдать
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via
ВысокаяCVSS 7,5Proof of conceptEPSS 28 %ntp · ntp6 мар. 2018 г.
- CVE-2018-773955В плане
antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters,
КритическаяCVSS 9,8Proof of conceptEPSS 53 %antsle · antman6 мар. 2018 г.
- CVE-2018-774534Наблюдать
An issue was discovered in Western Bridge Cobub Razor 0.7.2.
ВысокаяCVSS 7,5Proof of conceptEPSS 12 %cobub · razor7 мар. 2018 г.
- CVE-2017-1536746В плане
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database
КритическаяCVSS 9,8Proof of conceptEPSS 23 %bacula · bacula-web7 мар. 2018 г.
- CVE-2018-014774На этой неделе
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthe
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 18 %cisco · secure access control system8 мар. 2018 г.
- CVE-2018-121645В плане
A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enab
КритическаяCVSS 9,8Эксплойта нетEPSS 21 %dell · emc solutions enabler virtual appliance8 мар. 2018 г.
- CVE-2018-718342В плане
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by lever
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %ntp · ntp8 мар. 2018 г.
- CVE-2018-789063На этой неделе
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640).
КритическаяCVSS 9,8Готовый эксплойтEPSS 78 %zohocorp · manageengine applications manager8 мар. 2018 г.
- CVE-2018-758241В плане
WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.
ВысокаяCVSS 7,5Proof of conceptEPSS 36 %weblogexpert · weblog expert9 мар. 2018 г.
- CVE-2018-805634Наблюдать
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/manage/channel/addchan
ВысокаяCVSS 7,5Proof of conceptEPSS 12 %cobub · razor11 мар. 2018 г.
- CVE-2018-805746В плане
A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/
КритическаяCVSS 9,8Proof of conceptEPSS 21 %westernbridgegroup · razor11 мар. 2018 г.
- CVE-2018-806560На этой неделе
An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24.
ВысокаяCVSS 7,5Готовый эксплойтEPSS 75 %flexense · syncbreeze12 мар. 2018 г.
- CVE-2017-261933Наблюдать
Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the serv
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %samba · samba12 мар. 2018 г.
- CVE-2018-132344В плане
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to
ВысокаяCVSS 7,5Proof of conceptEPSS 46 %apache · tomcat jk connector12 мар. 2018 г.
- CVE-2018-100009440В плане
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admi
ВысокаяCVSS 7,2Готовый эксплойтEPSS 38 %cmsmadesimple · cms made simple12 мар. 2018 г.
- CVE-2018-105738Наблюдать
On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LD
ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %samba · samba13 мар. 2018 г.
- CVE-2017-100210142В плане
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with
КритическаяCVSS 9,6Proof of conceptEPSS 12 %kubernetes · kubernetes13 мар. 2018 г.
- CVE-2018-775047В плане
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x
КритическаяCVSS 9,8Proof of conceptEPSS 27 %paramiko · paramiko13 мар. 2018 г.
- CVE-2018-809653В плане
Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticatione
КритическаяCVSS 9,8Proof of conceptEPSS 48 %datalust · seq13 мар. 2018 г.
- CVE-2018-100012931Наблюдать
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript i
СредняяCVSS 6,1Proof of conceptEPSS 24 %jolokia · jolokia14 мар. 2018 г.
- CVE-2018-100013054В плане
A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java c
ВысокаяCVSS 8,1Proof of conceptEPSS 73 %jolokia · webarchive agent14 мар. 2018 г.
- CVE-2018-578245В плане
A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and
КритическаяCVSS 9,8Proof of conceptEPSS 18 %mitel · connect onsite14 мар. 2018 г.
- CVE-2018-087235Наблюдать
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %microsoft · edge14 мар. 2018 г.
- CVE-2018-087335Наблюдать
ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to h
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %microsoft · edge14 мар. 2018 г.
- CVE-2018-087435Наблюдать
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %microsoft · edge14 мар. 2018 г.
- CVE-2018-087635Наблюдать
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %microsoft · edge14 мар. 2018 г.
- CVE-2018-087818Наблюдать
Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2
НизкаяCVSS 3,1Proof of conceptEPSS 21 %microsoft · windows 1014 мар. 2018 г.
- CVE-2018-088334Наблюдать
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10
ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %microsoft · windows 1014 мар. 2018 г.
- CVE-2018-088653В плане
The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and
ВысокаяCVSS 7,0Proof of conceptEPSS 81 %microsoft · windows 1014 мар. 2018 г.
- CVE-2018-088935Наблюдать
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %microsoft · internet explorer14 мар. 2018 г.
- CVE-2018-089121Наблюдать
ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server
СредняяCVSS 4,3Proof of conceptEPSS 14 %microsoft · internet explorer14 мар. 2018 г.
- CVE-2018-089338Наблюдать
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en
ВысокаяCVSS 7,5Эксплойта нетEPSS 26 %microsoft · edge14 мар. 2018 г.
- CVE-2018-090336Наблюдать
Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code exec
ВысокаяCVSS 7,8Эксплойта нетEPSS 15 %microsoft · access14 мар. 2018 г.
- CVE-2018-091916Наблюдать
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2
НизкаяCVSS 3,3Эксплойта нетEPSS 11 %microsoft · office14 мар. 2018 г.
- CVE-2018-092236Наблюдать
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibil
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %microsoft · office14 мар. 2018 г.
- CVE-2018-092533Наблюдать
ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %microsoft · chakracore14 мар. 2018 г.
- CVE-2018-093033Наблюдать
ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles obje
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %microsoft · edge14 мар. 2018 г.
- CVE-2018-093133Наблюдать
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %microsoft · edge14 мар. 2018 г.
- CVE-2018-093350В плане
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr
ВысокаяCVSS 7,5Proof of conceptEPSS 66 %microsoft · edge14 мар. 2018 г.
- CVE-2018-093450В плане
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr
ВысокаяCVSS 7,5Proof of conceptEPSS 66 %microsoft · edge14 мар. 2018 г.
- CVE-2018-093547В плане
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi
ВысокаяCVSS 7,5Proof of conceptEPSS 55 %microsoft · internet explorer14 мар. 2018 г.
- CVE-2018-093635Наблюдать
ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %microsoft · edge14 мар. 2018 г.
- CVE-2018-093735Наблюдать
ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in mem
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %microsoft · edge14 мар. 2018 г.
- CVE-2018-094126Наблюдать
Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vu
СредняяCVSS 5,5Эксплойта нетEPSS 12 %microsoft · exchange server14 мар. 2018 г.
- CVE-2018-100012042В плане
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of se
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %debian · debian linux14 мар. 2018 г.
- CVE-2018-632860На этой неделе
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allo
КритическаяCVSS 9,8Готовый эксплойтEPSS 64 %kaseya · unitrends backup14 мар. 2018 г.
- CVE-2018-632960На этой неделе
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a
КритическаяCVSS 9,8Готовый эксплойтEPSS 61 %unitrends · backup14 мар. 2018 г.
- CVE-2018-770240В плане
SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to ar
КритическаяCVSS 9,1Proof of conceptEPSS 13 %securenvoy · securmail14 мар. 2018 г.
- CVE-2018-775657В плане
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which al
КритическаяCVSS 9,8Proof of conceptEPSS 60 %dewesoft · dewesoft14 мар. 2018 г.
- CVE-2018-804543В плане
In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User
ВысокаяCVSS 8,8Proof of conceptEPSS 28 %joomla · joomla\!14 мар. 2018 г.
- CVE-2018-871539Наблюдать
The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c.
ВысокаяCVSS 8,1Proof of conceptEPSS 22 %embedthis · appweb14 мар. 2018 г.
- CVE-2018-622342В плане
A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to man
КритическаяCVSS 9,8Proof of conceptEPSS 10 %trendmicro · email encryption gateway15 мар. 2018 г.
- CVE-2018-622842В плане
A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to
КритическаяCVSS 9,8Proof of conceptEPSS 10 %trendmicro · email encryption gateway15 мар. 2018 г.
- CVE-2018-622942В плане
A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL comma
КритическаяCVSS 9,8Proof of conceptEPSS 10 %trendmicro · email encryption gateway15 мар. 2018 г.
- CVE-2018-877039Наблюдать
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.
СредняяCVSS 5,3Proof of conceptEPSS 59 %cobub · razor18 мар. 2018 г.
- CVE-2018-742249В плане
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil
ВысокаяCVSS 7,5Proof of conceptEPSS 62 %siteeditor · site editor19 мар. 2018 г.
- CVE-2018-121835Наблюдать
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes
ВысокаяCVSS 7,5Proof of conceptEPSS 15 %dell · emc networker19 мар. 2018 г.
- CVE-2014-267435Наблюдать
Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary
ВысокаяCVSS 7,5Proof of conceptEPSS 15 %ajax-pagination project · ajax-pagination19 мар. 2018 г.
- CVE-2018-744587Срочно
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 60 %mikrotik · routeros19 мар. 2018 г.
- CVE-2017-1721558В плане
Huawei HG532 with some customized versions has a remote code execution vulnerability.
ВысокаяCVSS 8,8Proof of conceptEPSS 78 %huawei · hg532 firmware20 мар. 2018 г.
- CVE-2018-808843В плане
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restric
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %qos · slf4j20 мар. 2018 г.
- CVE-2018-132133Наблюдать
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1
ВысокаяCVSS 7,2Proof of conceptEPSS 17 %apache · syncope20 мар. 2018 г.
- CVE-2018-132225Наблюдать
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and
СредняяCVSS 4,9Proof of conceptEPSS 19 %apache · syncope20 мар. 2018 г.
- CVE-2018-882848В плане
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2.
КритическаяCVSS 9,8Эксплойта нетEPSS 30 %kamailio · kamailio20 мар. 2018 г.
- CVE-2018-120766На этой неделе
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code.
КритическаяCVSS 9,8Proof of conceptEPSS 90 %dell · emc idrac723 мар. 2018 г.
- CVE-2017-1773660На этой неделе
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/insta
КритическаяCVSS 9,8Proof of conceptEPSS 68 %kentico · xperience23 мар. 2018 г.
- CVE-2018-771944В плане
Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.
ВысокаяCVSS 7,5Proof of conceptEPSS 46 %acrolinx · acrolinx server25 мар. 2018 г.
- CVE-2018-894733Наблюдать
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attack
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %laravel log viewer project · laravel log viewer25 мар. 2018 г.
- CVE-2017-1571035Наблюдать
In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the
ВысокаяCVSS 7,5Эксплойта нетEPSS 17 %apache · http server26 мар. 2018 г.
- CVE-2017-1571558В плане
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, ra
ВысокаяCVSS 8,1Proof of conceptEPSS 85 %apache · http server26 мар. 2018 г.
- CVE-2018-130127Наблюдать
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size li
СредняяCVSS 5,9Эксплойта нетEPSS 14 %apache · http server26 мар. 2018 г.
- CVE-2018-130227Наблюдать
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer po
СредняяCVSS 5,9Эксплойта нетEPSS 12 %apache · http server26 мар. 2018 г.
- CVE-2018-130351В плане
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while
ВысокаяCVSS 7,5Эксплойта нетEPSS 69 %apache · http server26 мар. 2018 г.
- CVE-2018-131244В плане
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not co
КритическаяCVSS 9,8Эксплойта нетEPSS 15 %apache · http server26 мар. 2018 г.
- CVE-2018-118927Наблюдать
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affe
СредняяCVSS 4,8Proof of conceptEPSS 27 %dell · emc isilon26 мар. 2018 г.
- CVE-2018-765842В плане
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by s
ВысокаяCVSS 7,5Proof of conceptEPSS 38 %softros · network time system26 мар. 2018 г.
- CVE-2018-903247В плане
An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmwar
КритическаяCVSS 9,8Proof of conceptEPSS 27 %dlink · dir-850l firmware26 мар. 2018 г.
- CVE-2017-1231960На этой неделе
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow a
СредняяCVSS 5,9KEVГотовый эксплойтEPSS 5 %cisco · ios27 мар. 2018 г.
- CVE-2018-770057В плане
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify
ВысокаяCVSS 8,8Proof of conceptEPSS 74 %dedecms · dedecms27 мар. 2018 г.
- CVE-2018-688263На этой неделе
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7
СредняяCVSS 6,1KEVГотовый эксплойтEPSS 29 %synacor · zimbra collaboration suite27 мар. 2018 г.
- CVE-2018-073932Наблюдать
Constructed ASN.1 types with a recursive definition could exceed the stack
СредняяCVSS 6,5Эксплойта нетEPSS 18 %openssl · openssl27 мар. 2018 г.
- CVE-2018-882354В плане
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 thro
КритическаяCVSS 9,8Proof of conceptEPSS 50 %prestashop · prestashop27 мар. 2018 г.
- CVE-2018-015173На этой неделе
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, re
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 14 %cisco · ios xe28 мар. 2018 г.
- CVE-2018-015462На этой неделе
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an una
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 7 %cisco · ios28 мар. 2018 г.
- CVE-2018-015566На этой неделе
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Cata
ВысокаяCVSS 8,6KEVГотовый эксплойтEPSS 7 %cisco · ios28 мар. 2018 г.
- CVE-2018-015663На этой неделе
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 9 %cisco · ios28 мар. 2018 г.
- CVE-2018-015866На этой неделе
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthe
ВысокаяCVSS 8,6KEVГотовый эксплойтEPSS 7 %cisco · ios28 мар. 2018 г.