Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: август 2018 г.

103 записей · 8 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

Страница 1 из 2

  • CVE-2018-8034
    36Наблюдать

    The host name verification when using TLS with the WebSocket client was missing.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 21 %

    apache · tomcat1 авг. 2018 г.

  • CVE-2018-3924
    44В плане

    An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096.

    ВысокаяCVSS 7,8Эксплойта нетEPSS 43 %

    foxitsoftware · foxit reader1 авг. 2018 г.

  • CVE-2018-14847
    95Срочно

    MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write a

    КритическаяCVSS 9,1KEVГотовый эксплойтEPSS 95 %

    mikrotik · routeros2 авг. 2018 г.

  • CVE-2018-8032
    27Наблюдать

    Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

    СредняяCVSS 6,1Proof of conceptEPSS 10 %

    apache · axis2 авг. 2018 г.

  • CVE-2018-1336
    36Наблюдать

    An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Den

    ВысокаяCVSS 7,5Эксплойта нетEPSS 20 %

    apache · tomcat2 авг. 2018 г.

  • CVE-2018-8037
    26Наблюдать

    If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed

    СредняяCVSS 5,9Эксплойта нетEPSS 11 %

    apache · tomcat2 авг. 2018 г.

  • CVE-2018-13416
    45В плане

    In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing

    КритическаяCVSS 9,8Proof of conceptEPSS 19 %

    spirton · universal media server3 авг. 2018 г.

  • CVE-2018-14574
    32Наблюдать

    django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

    СредняяCVSS 6,1Proof of conceptEPSS 25 %

    djangoproject · django3 авг. 2018 г.

  • CVE-2018-14773
    43В плане

    An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13

    СредняяCVSS 6,5Эксплойта нетEPSS 57 %

    sensiolabs · symfony3 авг. 2018 г.

  • CVE-2018-14728
    62На этой неделе

    upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.

    КритическаяCVSS 9,8Proof of conceptEPSS 76 %

    tecrail · responsive filemanager3 авг. 2018 г.

  • CVE-2018-7748
    36Наблюдать

    report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scri

    ВысокаяCVSS 8,8Эксплойта нетEPSS 2 %

    servicenow · servicenow3 авг. 2018 г.

  • CVE-2018-14912
    60На этой неделе

    cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrate

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 91 %

    cgit project · cgit3 авг. 2018 г.

  • CVE-2018-14417
    66На этой неделе

    A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3.

    КритическаяCVSS 9,8Proof of conceptEPSS 89 %

    softnas · cloud3 авг. 2018 г.

  • CVE-2018-14933
    97Срочно

    upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeup

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 94 %

    nuuo · nvrmini firmware4 авг. 2018 г.

  • CVE-2017-6920
    45В плане

    Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects s

    КритическаяCVSS 9,8Эксплойта нетEPSS 20 %

    drupal · drupal6 авг. 2018 г.

  • CVE-2016-4391
    45В плане

    A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.

    КритическаяCVSS 9,8Эксплойта нетEPSS 18 %

    hp · arcsight winc connector6 авг. 2018 г.

  • CVE-2016-4402
    43В плане

    A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.

    КритическаяCVSS 9,8Эксплойта нетEPSS 14 %

    hp · keyview6 авг. 2018 г.

  • CVE-2016-4403
    43В плане

    A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.

    КритическаяCVSS 9,8Эксплойта нетEPSS 12 %

    hp · keyview6 авг. 2018 г.

  • CVE-2016-4404
    43В плане

    A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.

    КритическаяCVSS 9,8Эксплойта нетEPSS 13 %

    hp · keyview6 авг. 2018 г.

  • CVE-2016-8526
    38Наблюдать

    Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE).

    ВысокаяCVSS 8,8Proof of conceptEPSS 10 %

    hp · airwave6 авг. 2018 г.

  • CVE-2016-8527
    28Наблюдать

    Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS).

    СредняяCVSS 6,1Proof of conceptEPSS 13 %

    hp · airwave6 авг. 2018 г.

  • CVE-2017-8990
    44В плане

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software earl

    КритическаяCVSS 9,8Эксплойта нетEPSS 15 %

    hp · imc wireless service manager6 авг. 2018 г.

  • CVE-2018-14716
    40В плане

    A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match

    ВысокаяCVSS 7,5Proof of conceptEPSS 32 %

    nystudio107 · seomatic6 авг. 2018 г.

  • CVE-2018-5390
    51В плане

    Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can

    ВысокаяCVSS 7,5Эксплойта нетEPSS 71 %

    linux · linux kernel6 авг. 2018 г.

  • CVE-2018-7074
    44В плане

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07.

    КритическаяCVSS 9,8Эксплойта нетEPSS 15 %

    hp · intelligent management center6 авг. 2018 г.

  • CVE-2018-7092
    37Наблюдать

    A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 24 %

    hp · intelligent management center6 авг. 2018 г.

  • CVE-2018-15137
    44В плане

    CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remot

    КритическаяCVSS 9,8Proof of conceptEPSS 17 %

    cela link · clr-m20 firmware7 авг. 2018 г.

  • CVE-2018-15133
    85Срочно

    In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a pote

    ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 76 %

    laravel · laravel9 авг. 2018 г.

  • CVE-2018-10931
    59В плане

    It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC.

    КритическаяCVSS 9,8Proof of conceptEPSS 68 %

    cobbler project · cobbler9 авг. 2018 г.

  • CVE-2018-11492
    33Наблюдать

    ASUS HG100 devices allow denial of service via an IPv4 packet flood.

    ВысокаяCVSS 7,5Proof of conceptEPSS 11 %

    asus · hg100 firmware10 авг. 2018 г.

  • CVE-2018-14028
    33Наблюдать

    In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files.

    ВысокаяCVSS 7,2Эксплойта нетEPSS 15 %

    wordpress · wordpress10 авг. 2018 г.

  • CVE-2018-10630
    42В плане

    For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication di

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    crestron · tsw-x60 firmware10 авг. 2018 г.

  • CVE-2018-5924
    42В плане

    A security vulnerability has been identified with certain HP Inkjet printers.

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    hp · t8x44 firmware13 авг. 2018 г.

  • CVE-2018-11770
    40В плане

    From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism u

    СредняяCVSS 4,2Готовый эксплойтEPSS 65 %

    apache · spark13 авг. 2018 г.

  • CVE-2018-13415
    48В плане

    In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE

    КритическаяCVSS 9,8Proof of conceptEPSS 31 %

    plex · media server13 авг. 2018 г.

  • CVE-2018-13417
    45В плане

    In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XX

    КритическаяCVSS 9,8Proof of conceptEPSS 20 %

    vuze · bittorrent client13 авг. 2018 г.

  • CVE-2018-15139
    41В плане

    Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attack

    ВысокаяCVSS 8,8Proof of conceptEPSS 19 %

    open-emr · openemr13 авг. 2018 г.

  • CVE-2018-15140
    31Наблюдать

    Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien

    СредняяCVSS 6,5Proof of conceptEPSS 16 %

    open-emr · openemr13 авг. 2018 г.

  • CVE-2018-15141
    30Наблюдать

    Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien

    СредняяCVSS 6,5Proof of conceptEPSS 14 %

    open-emr · openemr13 авг. 2018 г.

  • CVE-2018-15142
    40В плане

    Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien

    ВысокаяCVSS 8,8Proof of conceptEPSS 17 %

    open-emr · openemr13 авг. 2018 г.

  • CVE-2016-4975
    30Наблюдать

    mod_userdir CRLF injection

    СредняяCVSS 6,1Proof of conceptEPSS 19 %

    apache · http server14 авг. 2018 г.

  • CVE-2018-15138
    34Наблюдать

    Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.

    ВысокаяCVSS 7,5Proof of conceptEPSS 12 %

    ericssonlg · ipecs nms15 авг. 2018 г.

  • CVE-2018-15152
    44В плане

    Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access

    КритическаяCVSS 9,1Proof of conceptEPSS 25 %

    open-emr · openemr15 авг. 2018 г.

  • CVE-2018-15153
    53В плане

    OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

    ВысокаяCVSS 8,8Эксплойта нетEPSS 61 %

    open-emr · openemr15 авг. 2018 г.

  • CVE-2018-15154
    38Наблюдать

    OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

    ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %

    open-emr · openemr15 авг. 2018 г.

  • CVE-2018-15155
    38Наблюдать

    OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

    ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %

    open-emr · openemr15 авг. 2018 г.

  • CVE-2018-15156
    38Наблюдать

    OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

    ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %

    open-emr · openemr15 авг. 2018 г.

  • CVE-2018-8266
    38Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 27 %

    microsoft · chakracore15 авг. 2018 г.

  • CVE-2018-8273
    48В плане

    A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Micros

    КритическаяCVSS 9,8Эксплойта нетEPSS 29 %

    microsoft · sql server15 авг. 2018 г.

  • CVE-2018-8302
    47В плане

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak

    КритическаяCVSS 9,8Эксплойта нетEPSS 25 %

    microsoft · exchange server15 авг. 2018 г.

  • CVE-2018-8316
    34Наблюдать

    A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries, aka

    ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8344
    41В плане

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso

    ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %

    microsoft · windows 1015 авг. 2018 г.

  • CVE-2018-8345
    34Наблюдать

    A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "L

    ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %

    microsoft · windows 1015 авг. 2018 г.

  • CVE-2018-8346
    41В плане

    A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "L

    ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %

    microsoft · windows 715 авг. 2018 г.

  • CVE-2018-8349
    42В плане

    A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Micros

    ВысокаяCVSS 8,8Эксплойта нетEPSS 22 %

    microsoft · windows 1015 авг. 2018 г.

  • CVE-2018-8350
    41В плане

    A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory, aka "Windows PDF Remot

    ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %

    microsoft · windows 1015 авг. 2018 г.

  • CVE-2018-8353
    50В плане

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    ВысокаяCVSS 7,5Proof of conceptEPSS 67 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8355
    50В плане

    A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

    ВысокаяCVSS 7,5Proof of conceptEPSS 68 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8359
    34Наблюдать

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore15 авг. 2018 г.

  • CVE-2018-8371
    34Наблюдать

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8372
    37Наблюдать

    A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

    ВысокаяCVSS 7,5Эксплойта нетEPSS 24 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8373
    79На этой неделе

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 61 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8375
    36Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 16 %

    microsoft · excel15 авг. 2018 г.

  • CVE-2018-8376
    40В плане

    A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory,

    ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %

    microsoft · powerpoint15 авг. 2018 г.

  • CVE-2018-8379
    36Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %

    microsoft · excel15 авг. 2018 г.

  • CVE-2018-8380
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore15 авг. 2018 г.

  • CVE-2018-8381
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore15 авг. 2018 г.

  • CVE-2018-8382
    26Наблюдать

    An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In

    СредняяCVSS 5,5Эксплойта нетEPSS 12 %

    microsoft · excel15 авг. 2018 г.

  • CVE-2018-8384
    49В плане

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Proof of conceptEPSS 62 %

    microsoft · chakracore15 авг. 2018 г.

  • CVE-2018-8385
    34Наблюдать

    A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8389
    39Наблюдать

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    ВысокаяCVSS 7,5Proof of conceptEPSS 28 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8390
    34Наблюдать

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore15 авг. 2018 г.

  • CVE-2018-8397
    55В плане

    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka

    ВысокаяCVSS 8,8Эксплойта нетEPSS 67 %

    microsoft · windows 715 авг. 2018 г.

  • CVE-2018-8403
    34Наблюдать

    A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr

    ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %

    microsoft · internet explorer15 авг. 2018 г.

  • CVE-2018-8405
    62На этой неделе

    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 3 %

    microsoft · windows 10 150715 авг. 2018 г.

  • CVE-2018-8406
    62На этой неделе

    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 3 %

    microsoft · windows 10 150715 авг. 2018 г.

  • CVE-2018-8414
    87Срочно

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Ex

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 72 %

    microsoft · windows 10 170315 авг. 2018 г.

  • CVE-2018-14007
    56В плане

    Citrix XenServer 7.1 and newer allows Directory Traversal.

    КритическаяCVSS 9,8Эксплойта нетEPSS 56 %

    citrix · xenserver15 авг. 2018 г.

  • CVE-2018-11509
    43В плане

    ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are instal

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    asustor · asustor data master16 авг. 2018 г.

  • CVE-2018-11511
    42В плане

    The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'a

    КритическаяCVSS 9,8Proof of conceptEPSS 11 %

    asustor · asustor data master16 авг. 2018 г.

  • CVE-2018-14058
    40В плане

    Pimcore before 5.3.0 allows SQL Injection via the REST web service API.

    СредняяCVSS 6,5Готовый эксплойтEPSS 28 %

    pimcore · pimcore17 авг. 2018 г.

  • CVE-2018-15473
    60На этой неделе

    OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after

    СредняяCVSS 5,3Готовый эксплойтEPSS 98 %

    openbsd · openssh17 авг. 2018 г.

  • CVE-2018-15494
    40В плане

    In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.

    КритическаяCVSS 9,8Эксплойта нетEPSS 2 %

    dojotoolkit · dojo17 авг. 2018 г.

  • CVE-2018-1000226
    43В плане

    Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older version

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    cobblerd · cobbler20 авг. 2018 г.

  • CVE-2018-15534
    49В плане

    Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hash

    КритическаяCVSS 9,8Proof of conceptEPSS 32 %

    geutebrueck · re porter 16 firmware21 авг. 2018 г.

  • CVE-2018-11776
    92Срочно

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei

    ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 99 %

    apache · struts22 авг. 2018 г.

  • CVE-2018-1140
    29Наблюдать

    A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server.

    СредняяCVSS 6,5Эксплойта нетEPSS 10 %

    samba · samba22 авг. 2018 г.

  • CVE-2018-15685
    35Наблюдать

    GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sand

    ВысокаяCVSS 8,1Proof of conceptEPSS 10 %

    electronjs · electron23 авг. 2018 г.

  • CVE-2018-15120
    29Наблюдать

    libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (applic

    СредняяCVSS 6,5Proof of conceptEPSS 11 %

    gnome · pango24 авг. 2018 г.

  • CVE-2018-15535
    44В плане

    /filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be withi

    ВысокаяCVSS 7,5Proof of conceptEPSS 45 %

    tecrail · responsive filemanager24 авг. 2018 г.

  • CVE-2018-3786
    43В плане

    A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line

    КритическаяCVSS 9,8Proof of conceptEPSS 12 %

    eggjs · egg-scripts24 авг. 2018 г.

  • CVE-2018-15877
    58В плане

    The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 76 %

    plainview activity monitor project · plainview activity monitor26 авг. 2018 г.

  • CVE-2015-9263
    43В плане

    An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13).

    КритическаяCVSS 9,8Эксплойта нетEPSS 13 %

    idera · uptime infrastructure monitor27 авг. 2018 г.

  • CVE-2018-15839
    53В плане

    D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.

    КритическаяCVSS 9,8Proof of conceptEPSS 45 %

    dlink · dir-615 firmware28 авг. 2018 г.

  • CVE-2018-12824
    26Наблюдать

    Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.

    СредняяCVSS 5,9Эксплойта нетEPSS 10 %

    adobe · flash player desktop runtime29 авг. 2018 г.

  • CVE-2018-12827
    40В плане

    Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.

    ВысокаяCVSS 7,5Proof of conceptEPSS 32 %

    adobe · flash player29 авг. 2018 г.

  • CVE-2018-15727
    60На этой неделе

    Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember

    КритическаяCVSS 9,8Готовый эксплойтEPSS 64 %

    grafana · grafana29 авг. 2018 г.

  • CVE-2018-12710
    55В плане

    An issue was discovered on D-Link DIR-601 2.02NA devices.

    ВысокаяCVSS 8,0Proof of conceptEPSS 76 %

    dlink · dir-601 firmware29 авг. 2018 г.

  • CVE-2018-16133
    33Наблюдать

    Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.

    СредняяCVSS 5,3Proof of conceptEPSS 39 %

    cybrotech · cybrohttpserver29 авг. 2018 г.

  • CVE-2018-16158
    60На этой неделе

    Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installation

    КритическаяCVSS 9,8Готовый эксплойтEPSS 34 %

    eaton · power xpert meter 4000 firmware30 авг. 2018 г.