Эксплуатируемые и новые серьёзные CVE: октябрь 2018 г.

Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a

• RCE
• Ошибки памяти

zahiraccounting · zahir enterprise plus3 окт. 2018 г.

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.

• Без аутентификации
• Обход аутентификации
• SQL-инъекция

naviwebs · navigate cms3 окт. 2018 г.

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allo

• RCE
• Обход пути
• Загрузка файлов

naviwebs · navigate cms3 окт. 2018 г.

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directo

• Без аутентификации
• Открытый редирект

apache · tomcat4 окт. 2018 г.

Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service Vulnerability

• Без аутентификации
• Отказ в обслуживании

cisco · ios xe5 окт. 2018 г.

Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability

• Без аутентификации
• Отказ в обслуживании

cisco · ios xe5 окт. 2018 г.

Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability

• RCE без входа
• Обход аутентификации
• Загрузка файлов

cisco · prime infrastructure5 окт. 2018 г.

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows r

• RCE без входа

git-scm · git6 окт. 2018 г.

ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an actio

• Без аутентификации
• Обход аутентификации

extplorer · extplorer7 окт. 2018 г.

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1.

• RCE без входа
• Загрузка файлов
• Зашитые учётные данные

dlink · central wifimanager8 окт. 2018 г.

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1.

• RCE
• Загрузка файлов

dlink · central wifimanager8 окт. 2018 г.

_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated att

• Ошибки памяти
• Отказ в обслуживании

net-snmp · net-snmp8 окт. 2018 г.

process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (s

• Без аутентификации
• XSS

wpml · wpml8 окт. 2018 г.

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode.

• RCE без входа
• Инъекция команд

redhat · enterprise linux desktop9 окт. 2018 г.

A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft

• RCE

microsoft · exchange server10 окт. 2018 г.

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NE

• Без аутентификации
• Утечка информации

microsoft · asp.net core10 окт. 2018 г.

A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code

• RCE

microsoft · windows 1010 окт. 2018 г.

A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution

• RCE
• Ошибки памяти

microsoft · windows 1010 окт. 2018 г.

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics

• RCE

microsoft · excel viewer10 окт. 2018 г.

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k

• Локальное повышение привилегий

microsoft · windows 10 150710 окт. 2018 г.

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

• RCE без входа
• Ошибки памяти

microsoft · internet explorer10 окт. 2018 г.

An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowi

• Утечка информации

microsoft · windows 1010 окт. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 окт. 2018 г.

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

• RCE без входа
• Ошибки памяти

microsoft · internet explorer10 окт. 2018 г.

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code

• RCE без входа
• XXE

microsoft · windows 1010 окт. 2018 г.

A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerabil

• RCE без входа
• Обход пути

microsoft · windows 1010 окт. 2018 г.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 окт. 2018 г.

A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protecte

• RCE без входа

microsoft · office10 окт. 2018 г.

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected Vie

• RCE без входа

microsoft · excel10 окт. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 окт. 2018 г.

A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View

• RCE без входа

microsoft · office10 окт. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 окт. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа
• Ошибки памяти

microsoft · edge10 окт. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 окт. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 окт. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 окт. 2018 г.

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing

• XXE

microsoft · sql server management studio10 окт. 2018 г.

A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory,

• RCE без входа
• Ошибки памяти

microsoft · azure internet of things edge10 окт. 2018 г.

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containin

• XXE

microsoft · sql server management studio10 окт. 2018 г.

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containin

• XXE

microsoft · sql server management studio10 окт. 2018 г.

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp pa

• Без аутентификации
• XSS

apache · activemq10 окт. 2018 г.

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx

• Без аутентификации

episerver · ektron cms10 окт. 2018 г.

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

• Без аутентификации
• Загрузка файлов

jquery file upload project · jquery file upload11 окт. 2018 г.

NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active

• RCE без входа
• Слабая криптография

nuuo · nuuo cms12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a heap overflo

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a heap overflo

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a heap overflo

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a heap overflo

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a stack overfl

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a heap overflo

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a heap overflo

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an use after f

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an untrusted p

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an untrusted p

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an untrusted p

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• RCE
• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-boun

• Ошибки памяти

adobe · acrobat dc12 окт. 2018 г.

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start

• RCE без входа
• Инъекция команд

control-webpanel · webpanel15 окт. 2018 г.

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fil

• Без аутентификации
• Обход пути

control-webpanel · webpanel15 окт. 2018 г.

Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autolo

• RCE без входа
• Инъекция команд

teltonika · rut900 firmware15 окт. 2018 г.

Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monito

• Без аутентификации

oracle · application management pack16 окт. 2018 г.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

• Без аутентификации

oracle · weblogic server16 окт. 2018 г.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

• Без аутентификации
• Десериализация

oracle · weblogic server16 окт. 2018 г.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

• Без аутентификации

oracle · weblogic server16 окт. 2018 г.

Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are suscept

• RCE
• Инъекция команд

linksys · e1200 firmware16 окт. 2018 г.

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4.

• Без аутентификации

libssh · libssh17 окт. 2018 г.

A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) prior to iMC PLAT 7.3 E0605P04.

• RCE без входа
• Обход аутентификации

hp · intelligent management center17 окт. 2018 г.

Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512

• Без аутентификации
• Обход пути

dlink · dwr-116 firmware17 окт. 2018 г.

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.

• RCE
• Инъекция команд

dlink · dwr-116 firmware17 окт. 2018 г.

An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through

• Без аутентификации
• Обход пути

dlink · dwr-116 firmware17 окт. 2018 г.

Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability.

• RCE без входа
• Ошибки памяти

adobe · digital editions17 окт. 2018 г.