Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: апрель 2018 г.

107 записей · 3 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

Страница 1 из 2

  • CVE-2018-6849
    60На этой неделе

    In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://

    СредняяCVSS 4,3Готовый эксплойтEPSS 28 %

    duckduckgo · duckduckgo1 апр. 2018 г.

  • CVE-2018-9230
    43В плане

    In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore pa

    КритическаяCVSS 9,8Эксплойта нетEPSS 13 %

    openresty · openresty2 апр. 2018 г.

  • CVE-2018-4121
    39Наблюдать

    An issue was discovered in certain Apple products.

    ВысокаяCVSS 8,8Proof of conceptEPSS 13 %

    apple · safari3 апр. 2018 г.

  • CVE-2018-4162
    60На этой неделе

    An issue was discovered in certain Apple products.

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 37 %

    apple · safari3 апр. 2018 г.

  • CVE-2018-6914
    33Наблюдать

    Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    ruby-lang · ruby3 апр. 2018 г.

  • CVE-2018-9234
    31Наблюдать

    GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a

    ВысокаяCVSS 7,5Эксплойта нетEPSS 1 %

    gnupg · gnupg3 апр. 2018 г.

  • CVE-2016-10718
    34Наблюдать

    Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.

    ВысокаяCVSS 7,5Proof of conceptEPSS 12 %

    brave · brave browser3 апр. 2018 г.

  • CVE-2018-9205
    47В плане

    Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.

    ВысокаяCVSS 7,5Proof of conceptEPSS 55 %

    drupal · avatar uploader4 апр. 2018 г.

  • CVE-2018-9248
    43В плане

    FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.

    КритическаяCVSS 9,8Proof of conceptEPSS 14 %

    fiberhome · vdsl2 modem hg 150-ub firmware4 апр. 2018 г.

  • CVE-2018-0986
    54В плане

    A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, l

    ВысокаяCVSS 8,8Proof of conceptEPSS 63 %

    microsoft · exchange server4 апр. 2018 г.

  • CVE-2018-8719
    26Наблюдать

    An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress.

    СредняяCVSS 5,3Proof of conceptEPSS 15 %

    wpsecurityauditlog · wp security audit log4 апр. 2018 г.

  • CVE-2018-9126
    54В плане

    The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover databa

    КритическаяCVSS 9,8Proof of conceptEPSS 48 %

    zldnn · dnnarticle4 апр. 2018 г.

  • CVE-2016-8371
    32Наблюдать

    The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.

    ВысокаяCVSS 7,3Proof of conceptEPSS 10 %

    phoenixcontact · ilc plcs firmware5 апр. 2018 г.

  • CVE-2016-8380
    32Наблюдать

    The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.

    ВысокаяCVSS 7,3Proof of conceptEPSS 10 %

    phoenixcontact · ilc plcs firmware5 апр. 2018 г.

  • CVE-2017-14462
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 35 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14463
    51В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 38 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14464
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14465
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 35 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14466
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14467
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14468
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14469
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14470
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14471
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14472
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2017-14473
    50В плане

    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl

    КритическаяCVSS 9,8Эксплойта нетEPSS 37 %

    rockwellautomation · micrologix 1400 b firmware5 апр. 2018 г.

  • CVE-2018-1271
    33Наблюдать

    Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configu

    СредняяCVSS 5,9Proof of conceptEPSS 34 %

    vmware · spring framework6 апр. 2018 г.

  • CVE-2018-1270
    62На этой неделе

    Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose

    КритическаяCVSS 9,8Proof of conceptEPSS 77 %

    vmware · spring framework6 апр. 2018 г.

  • CVE-2018-1308
    36Наблюдать

    This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inl

    ВысокаяCVSS 7,5Эксплойта нетEPSS 20 %

    apache · solr9 апр. 2018 г.

  • CVE-2018-1217
    54В плане

    Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1

    КритическаяCVSS 9,8Proof of conceptEPSS 50 %

    dell · emc avamar9 апр. 2018 г.

  • CVE-2014-1889
    29Наблюдать

    The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrar

    СредняяCVSS 6,5Proof of conceptEPSS 10 %

    buddypress · buddypress10 апр. 2018 г.

  • CVE-2018-9995
    64На этой неделе

    TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login

    КритическаяCVSS 9,8Proof of conceptEPSS 82 %

    tbkvision · tbk-dvr4216 firmware10 апр. 2018 г.

  • CVE-2018-1273
    98Срочно

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 96 %

    broadcom · spring data commons11 апр. 2018 г.

  • CVE-2018-1275
    56В плане

    Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose

    КритическаяCVSS 9,8Эксплойта нетEPSS 57 %

    vmware · spring framework11 апр. 2018 г.

  • CVE-2017-14459
    43В плане

    An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IE

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    moxa · awk-3131a firmware11 апр. 2018 г.

  • CVE-2018-10054
    45В плане

    H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary J

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 33 %

    cognitect · datomic11 апр. 2018 г.

  • CVE-2018-0870
    35Наблюдать

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-0920
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %

    microsoft · excel11 апр. 2018 г.

  • CVE-2018-0956
    34Наблюдать

    A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-0967
    27Наблюдать

    A denial of service vulnerability exists in the way that Windows SNMP Service handles malformed SNMP traps, aka "Windows SNMP Service Denial

    СредняяCVSS 5,3Эксплойта нетEPSS 18 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-0979
    35Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · edge11 апр. 2018 г.

  • CVE-2018-0980
    50В плане

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Proof of conceptEPSS 66 %

    microsoft · edge11 апр. 2018 г.

  • CVE-2018-0988
    35Наблюдать

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-0990
    35Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · edge11 апр. 2018 г.

  • CVE-2018-0991
    35Наблюдать

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-0993
    35Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · edge11 апр. 2018 г.

  • CVE-2018-0994
    35Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · edge11 апр. 2018 г.

  • CVE-2018-0995
    35Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · edge11 апр. 2018 г.

  • CVE-2018-0996
    34Наблюдать

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-0997
    35Наблюдать

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-1001
    34Наблюдать

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-1003
    38Наблюдать

    A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, ak

    ВысокаяCVSS 7,8Эксплойта нетEPSS 22 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-1004
    41В плане

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Rem

    ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-1010
    47В плане

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso

    ВысокаяCVSS 8,8Proof of conceptEPSS 39 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-1011
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · excel11 апр. 2018 г.

  • CVE-2018-1012
    42В плане

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso

    ВысокаяCVSS 8,8Эксплойта нетEPSS 23 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-1013
    42В плане

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso

    ВысокаяCVSS 8,8Эксплойта нетEPSS 23 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-1015
    42В плане

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso

    ВысокаяCVSS 8,8Эксплойта нетEPSS 23 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-1016
    42В плане

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso

    ВысокаяCVSS 8,8Эксплойта нетEPSS 23 %

    microsoft · windows 1011 апр. 2018 г.

  • CVE-2018-1018
    35Наблюдать

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-1019
    35Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    microsoft · edge11 апр. 2018 г.

  • CVE-2018-1020
    35Наблюдать

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    ВысокаяCVSS 7,5Эксплойта нетEPSS 16 %

    microsoft · internet explorer11 апр. 2018 г.

  • CVE-2018-1023
    34Наблюдать

    A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore11 апр. 2018 г.

  • CVE-2018-1026
    47В плане

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    ВысокаяCVSS 8,8Proof of conceptEPSS 40 %

    microsoft · office11 апр. 2018 г.

  • CVE-2018-1027
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · excel11 апр. 2018 г.

  • CVE-2018-1028
    41В плане

    A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Mi

    ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %

    microsoft · excel services11 апр. 2018 г.

  • CVE-2018-1029
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %

    microsoft · excel11 апр. 2018 г.

  • CVE-2018-1030
    42В плане

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    ВысокаяCVSS 8,8Эксплойта нетEPSS 24 %

    microsoft · office11 апр. 2018 г.

  • CVE-2018-9118
    44В плане

    exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a

    ВысокаяCVSS 7,5Proof of conceptEPSS 46 %

    99robots · wp background takeover advertisements12 апр. 2018 г.

  • CVE-2018-9842
    26Наблюдать

    CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message.

    СредняяCVSS 5,3Proof of conceptEPSS 15 %

    cyberark · password vault12 апр. 2018 г.

  • CVE-2018-9843
    44В плане

    The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    cyberark · password vault12 апр. 2018 г.

  • CVE-2018-5511
    32Наблюдать

    On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (T

    ВысокаяCVSS 7,2Proof of conceptEPSS 14 %

    f5 · big-ip local traffic manager13 апр. 2018 г.

  • CVE-2017-0358
    40В плане

    ntfs-3g: Modprobe influence vulnerability via environment variables

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 2 %

    tuxera · ntfs-3g13 апр. 2018 г.

  • CVE-2017-0372
    60На этой неделе

    Parameters injection in SyntaxHighlight results in multiple vulnerabilities

    КритическаяCVSS 9,8Готовый эксплойтEPSS 11 %

    mediawiki · mediawiki13 апр. 2018 г.

  • CVE-2018-6546
    44В плане

    plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, e

    КритическаяCVSS 9,8Proof of conceptEPSS 17 %

    plays.tv · plays.tv13 апр. 2018 г.

  • CVE-2014-2069
    35Наблюдать

    Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file paramet

    ВысокаяCVSS 7,5Proof of conceptEPSS 15 %

    eshtery.she7ata · eshtery cms16 апр. 2018 г.

  • CVE-2018-10070
    34Наблюдать

    A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM

    ВысокаяCVSS 7,5Proof of conceptEPSS 12 %

    mikrotik · router firmware16 апр. 2018 г.

  • CVE-2018-0737
    26Наблюдать

    Cache timing vulnerability in RSA Key Generation

    СредняяCVSS 5,9Эксплойта нетEPSS 11 %

    openssl · openssl16 апр. 2018 г.

  • CVE-2018-5430
    79На этой неделе

    TIBCO JasperReports Server Information Disclosure Vulnerability

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 48 %

    tibco · jasperreports server17 апр. 2018 г.

  • CVE-2018-6913
    42В плане

    Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a lar

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    perl · perl17 апр. 2018 г.

  • CVE-2018-8733
    60На этой неделе

    Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated atta

    КритическаяCVSS 9,8Готовый эксплойтEPSS 26 %

    nagios · nagios xi17 апр. 2018 г.

  • CVE-2018-8734
    60На этой неделе

    SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrar

    КритическаяCVSS 9,8Готовый эксплойтEPSS 53 %

    nagios · nagios xi17 апр. 2018 г.

  • CVE-2018-8735
    54В плане

    Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 63 %

    nagios · nagios xi17 апр. 2018 г.

  • CVE-2018-8736
    49В плане

    A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability esca

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 45 %

    nagios · nagios xi17 апр. 2018 г.

  • CVE-2018-8831
    40В плане

    A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the co

    СредняяCVSS 6,1Proof of conceptEPSS 52 %

    kodi · kodi18 апр. 2018 г.

  • CVE-2018-2628
    99Срочно

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %

    oracle · weblogic server18 апр. 2018 г.

  • CVE-2018-2791
    43В плане

    Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI).

    ВысокаяCVSS 8,2Proof of conceptEPSS 38 %

    oracle · webcenter sites18 апр. 2018 г.

  • CVE-2018-2799
    25Наблюдать

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP).

    СредняяCVSS 5,3Эксплойта нетEPSS 14 %

    oracle · jdk18 апр. 2018 г.

  • CVE-2018-2879
    42В плане

    Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).

    КритическаяCVSS 9,0Proof of conceptEPSS 21 %

    oracle · access manager18 апр. 2018 г.

  • CVE-2018-1143
    55В плане

    A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP reque

    КритическаяCVSS 9,8Эксплойта нетEPSS 54 %

    belkin · n750 firmware19 апр. 2018 г.

  • CVE-2018-1145
    46В плане

    A remote unauthenticated user can overflow a stack buffer in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP reques

    КритическаяCVSS 9,8Эксплойта нетEPSS 24 %

    belkin · n750 firmware19 апр. 2018 г.

  • CVE-2018-1146
    38Наблюдать

    A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.c

    ВысокаяCVSS 7,5Эксплойта нетEPSS 28 %

    belkin · n750 firmware19 апр. 2018 г.

  • CVE-2018-3843
    41В плане

    An exploitable type confusion vulnerability exists in the way Foxit PDF Reader version 9.0.1.1049 parses files with associated file annotati

    ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %

    foxitsoftware · foxit reader19 апр. 2018 г.

  • CVE-2018-10201
    43В плане

    An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11.

    ВысокаяCVSS 7,5Proof of conceptEPSS 43 %

    ncomputing · vspace pro20 апр. 2018 г.

  • CVE-2018-9059
    62На этой неделе

    Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious logi

    КритическаяCVSS 9,8Готовый эксплойтEPSS 77 %

    sharing-file · easy file sharing web server20 апр. 2018 г.

  • CVE-2018-10285
    43В плане

    The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms.

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    ericssonlg · ipecs nms22 апр. 2018 г.

  • CVE-2018-8880
    34Наблюдать

    Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP informat

    ВысокаяCVSS 7,5Proof of conceptEPSS 13 %

    lutron · quantum bacnet integration firmware23 апр. 2018 г.

  • CVE-2016-9587
    37Наблюдать

    Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems.

    ВысокаяCVSS 8,1Proof of conceptEPSS 17 %

    ansible · ansible24 апр. 2018 г.

  • CVE-2017-2885
    46В плане

    An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58.

    КритическаяCVSS 9,8Эксплойта нетEPSS 23 %

    gnome · libsoup24 апр. 2018 г.

  • CVE-2018-8716
    32Наблюдать

    WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.

    СредняяCVSS 5,4Proof of conceptEPSS 38 %

    wso2 · identity server25 апр. 2018 г.