Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: ноябрь 2018 г.

87 записей · 6 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2018-18777
    24Наблюдать

    Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote a

    СредняяCVSS 4,3Proof of conceptEPSS 22 %

    microstrategy · microstrategy web1 нояб. 2018 г.

  • CVE-2018-18925
    48В плане

    Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery

    КритическаяCVSS 9,8Proof of conceptEPSS 31 %

    gogs · gogs4 нояб. 2018 г.

  • CVE-2018-18926
    40В плане

    Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs.

    КритическаяCVSS 9,8Эксплойта нетEPSS 3 %

    gitea · gitea4 нояб. 2018 г.

  • CVE-2018-18949
    46В плане

    Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.

    КритическаяCVSS 9,8Эксплойта нетEPSS 24 %

    zohocorp · manageengine opmanager5 нояб. 2018 г.

  • CVE-2018-18820
    47В плане

    A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4.

    ВысокаяCVSS 8,1Proof of conceptEPSS 48 %

    xiph · icecast5 нояб. 2018 г.

  • CVE-2018-18957
    42В плане

    An issue has been found in libIEC61850 v1.3.

    КритическаяCVSS 9,8Proof of conceptEPSS 11 %

    mz-automation · libiec618505 нояб. 2018 г.

  • CVE-2018-18980
    37Наблюдать

    An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214

    ВысокаяCVSS 7,5Эксплойта нетEPSS 24 %

    zohocorp · manageengine network configuration manager6 нояб. 2018 г.

  • CVE-2018-14667
    91Срочно

    The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource.

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 74 %

    redhat · richfaces6 нояб. 2018 г.

  • CVE-2018-19052
    34Наблюдать

    An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50.

    ВысокаяCVSS 7,5Proof of conceptEPSS 13 %

    lighttpd · lighttpd7 нояб. 2018 г.

  • CVE-2018-16843
    44В плане

    nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.

    ВысокаяCVSS 7,5Proof of conceptEPSS 47 %

    f5 · nginx7 нояб. 2018 г.

  • CVE-2018-16844
    34Наблюдать

    nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %

    f5 · nginx7 нояб. 2018 г.

  • CVE-2018-8021
    55В плане

    Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code ex

    КритическаяCVSS 9,8Proof of conceptEPSS 53 %

    apache · superset7 нояб. 2018 г.

  • CVE-2018-15381
    65На этой неделе

    Cisco Unity Express Arbitrary Command Execution Vulnerability

    КритическаяCVSS 9,8Эксплойта нетEPSS 87 %

    cisco · unity express8 нояб. 2018 г.

  • CVE-2018-15439
    60На этой неделе

    Cisco Small Business Switches Privileged Access Vulnerability

    КритическаяCVSS 9,8Готовый эксплойтEPSS 49 %

    cisco · sg200-50 firmware8 нояб. 2018 г.

  • CVE-2018-19125
    33Наблюдать

    PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.

    ВысокаяCVSS 7,5Proof of conceptEPSS 10 %

    prestashop · prestashop9 нояб. 2018 г.

  • CVE-2018-19126
    46В плане

    PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.

    КритическаяCVSS 9,8Proof of conceptEPSS 22 %

    prestashop · prestashop9 нояб. 2018 г.

  • CVE-2018-19127
    45В плане

    A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a contro

    КритическаяCVSS 9,8Proof of conceptEPSS 20 %

    phpcms · phpcms9 нояб. 2018 г.

  • CVE-2018-19206
    41В плане

    steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY elem

    СредняяCVSS 6,1Эксплойта нетEPSS 55 %

    roundcube · webmail12 нояб. 2018 г.

  • CVE-2018-19207
    65На этой неделе

    The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code

    КритическаяCVSS 9,8Готовый эксплойтEPSS 88 %

    van-ons · wp-gdpr-compliance12 нояб. 2018 г.

  • CVE-2018-19246
    37Наблюдать

    PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access

    ВысокаяCVSS 7,5Proof of conceptEPSS 21 %

    php-proxy · php-proxy13 нояб. 2018 г.

  • CVE-2018-8256
    42В плане

    A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files, aka "Microsoft PowerShell Remote Co

    ВысокаяCVSS 8,8Эксплойта нетEPSS 22 %

    microsoft · microsoft.powershell.archive13 нояб. 2018 г.

  • CVE-2018-8450
    40В плане

    A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulner

    ВысокаяCVSS 8,8Эксплойта нетEPSS 16 %

    microsoft · windows 1013 нояб. 2018 г.

  • CVE-2018-8476
    58В плане

    A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "Windows

    КритическаяCVSS 9,8Эксплойта нетEPSS 64 %

    microsoft · windows server 200813 нояб. 2018 г.

  • CVE-2018-8522
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · office13 нояб. 2018 г.

  • CVE-2018-8524
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · office13 нояб. 2018 г.

  • CVE-2018-8539
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft W

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · office13 нояб. 2018 г.

  • CVE-2018-8541
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8542
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8543
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8544
    49В плане

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Rem

    ВысокаяCVSS 8,8Proof of conceptEPSS 47 %

    microsoft · windows 1013 нояб. 2018 г.

  • CVE-2018-8551
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8552
    45В плане

    An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacke

    ВысокаяCVSS 7,5Proof of conceptEPSS 50 %

    microsoft · internet explorer13 нояб. 2018 г.

  • CVE-2018-8553
    37Наблюдать

    A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · windows 1013 нояб. 2018 г.

  • CVE-2018-8555
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8556
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8557
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8570
    34Наблюдать

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · internet explorer13 нояб. 2018 г.

  • CVE-2018-8573
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft W

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · office13 нояб. 2018 г.

  • CVE-2018-8574
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · office13 нояб. 2018 г.

  • CVE-2018-8575
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in memory, aka "Microsof

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · office 365 proplus13 нояб. 2018 г.

  • CVE-2018-8576
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · office13 нояб. 2018 г.

  • CVE-2018-8577
    37Наблюдать

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    ВысокаяCVSS 7,8Эксплойта нетEPSS 19 %

    microsoft · excel13 нояб. 2018 г.

  • CVE-2018-8581
    67На этой неделе

    An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerabi

    ВысокаяCVSS 7,4KEVГотовый эксплойтEPSS 27 %

    microsoft · exchange server13 нояб. 2018 г.

  • CVE-2018-8582
    41В плане

    A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft O

    ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %

    microsoft · office 365 proplus13 нояб. 2018 г.

  • CVE-2018-8588
    34Наблюдать

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %

    microsoft · chakracore13 нояб. 2018 г.

  • CVE-2018-8589
    62На этой неделе

    An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privile

    ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 3 %

    microsoft · windows 713 нояб. 2018 г.

  • CVE-2018-17463
    90Срочно

    Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a s

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 84 %

    google · chrome14 нояб. 2018 г.

  • CVE-2018-6065
    83Срочно

    Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 60 %

    google · chrome14 нояб. 2018 г.

  • CVE-2018-7357
    61На этой неделе

    ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerab

    ВысокаяCVSS 8,8Proof of conceptEPSS 87 %

    zte · zxhn h168n firmware14 нояб. 2018 г.

  • CVE-2018-7358
    62На этой неделе

    ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerab

    ВысокаяCVSS 8,8Proof of conceptEPSS 89 %

    zte · zxhn h168n firmware14 нояб. 2018 г.

  • CVE-2018-15708
    66На этой неделе

    Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.

    КритическаяCVSS 9,8Готовый эксплойтEPSS 89 %

    nagios · nagios xi14 нояб. 2018 г.

  • CVE-2018-15709
    41В плане

    Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.

    ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %

    nagios · nagios xi14 нояб. 2018 г.

  • CVE-2018-15710
    44В плане

    Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 44 %

    nagios · nagios xi14 нояб. 2018 г.

  • CVE-2018-15711
    46В плане

    Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users.

    ВысокаяCVSS 8,8Эксплойта нетEPSS 36 %

    nagios · nagios xi14 нояб. 2018 г.

  • CVE-2018-15712
    39Наблюдать

    Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.

    СредняяCVSS 6,1Эксплойта нетEPSS 48 %

    nagios · nagios xi14 нояб. 2018 г.

  • CVE-2018-12543
    41В плане

    In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is n

    ВысокаяCVSS 7,5Эксплойта нетEPSS 36 %

    eclipse · mosquitto15 нояб. 2018 г.

  • CVE-2018-8529
    43В плане

    A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication betw

    КритическаяCVSS 9,8Эксплойта нетEPSS 13 %

    microsoft · team foundation server15 нояб. 2018 г.

  • CVE-2018-16395
    42В плане

    An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    ruby-lang · openssl16 нояб. 2018 г.

  • CVE-2018-18761
    44В плане

    SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.

    КритическаяCVSS 9,8Proof of conceptEPSS 16 %

    saltos · saltos16 нояб. 2018 г.

  • CVE-2018-18955
    40В плане

    In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it misha

    ВысокаяCVSS 7,0Готовый эксплойтEPSS 7 %

    linux · linux kernel16 нояб. 2018 г.

  • CVE-2018-19410
    98Срочно

    PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including admin

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 97 %

    paessler · prtg network monitor21 нояб. 2018 г.

  • CVE-2018-19422
    47В плане

    /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess fi

    ВысокаяCVSS 7,2Готовый эксплойтEPSS 64 %

    intelliants · subrion cms21 нояб. 2018 г.

  • CVE-2018-19423
    33Наблюдать

    Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.

    ВысокаяCVSS 7,2Proof of conceptEPSS 18 %

    codiad · codiad21 нояб. 2018 г.

  • CVE-2018-19458
    40В плане

    In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulne

    ВысокаяCVSS 7,5Proof of conceptEPSS 32 %

    php-proxy · php-proxy22 нояб. 2018 г.

  • CVE-2018-19518
    59В плане

    University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 96 %

    php · php25 нояб. 2018 г.

  • CVE-2018-13324
    46В плане

    Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified

    КритическаяCVSS 9,8Эксплойта нетEPSS 23 %

    buffalo · ts5600d1206 firmware26 нояб. 2018 г.

  • CVE-2018-13022
    24Наблюдать

    Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScrip

    СредняяCVSS 6,1Эксплойта нетEPSS 0 %

    mi · miwifi os27 нояб. 2018 г.

  • CVE-2018-13023
    42В плане

    System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via

    ВысокаяCVSS 8,8Эксплойта нетEPSS 23 %

    mi · miwifi os27 нояб. 2018 г.

  • CVE-2018-16130
    42В плане

    System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the

    ВысокаяCVSS 8,8Эксплойта нетEPSS 23 %

    mi · miwifi os27 нояб. 2018 г.

  • CVE-2018-17934
    60На этой неделе

    NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the in

    КритическаяCVSS 9,8Готовый эксплойтEPSS 19 %

    nuuo · nuuo cms27 нояб. 2018 г.

  • CVE-2018-17936
    60На этой неделе

    NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to

    КритическаяCVSS 9,8Готовый эксплойтEPSS 15 %

    nuuo · nuuo cms27 нояб. 2018 г.

  • CVE-2018-18982
    53В плане

    NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL

    ВысокаяCVSS 8,8Готовый эксплойтEPSS 60 %

    nuuo · nuuo cms27 нояб. 2018 г.

  • CVE-2018-13338
    42В плане

    System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" pa

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    terra-master · terramaster operating system27 нояб. 2018 г.

  • CVE-2018-13350
    44В плане

    SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter.

    КритическаяCVSS 9,8Эксплойта нетEPSS 16 %

    terra-master · terramaster operating system27 нояб. 2018 г.

  • CVE-2018-13354
    46В плане

    System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" param

    КритическаяCVSS 9,8Эксплойта нетEPSS 22 %

    terra-master · terramaster operating system27 нояб. 2018 г.

  • CVE-2018-13358
    42В плане

    System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" p

    ВысокаяCVSS 8,8Эксплойта нетEPSS 24 %

    terra-master · terramaster operating system27 нояб. 2018 г.

  • CVE-2018-13359
    41В плане

    Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter.

    ВысокаяCVSS 8,8Эксплойта нетEPSS 19 %

    terra-master · terramaster operating system27 нояб. 2018 г.

  • CVE-2018-13361
    26Наблюдать

    User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter.

    СредняяCVSS 5,3Эксплойта нетEPSS 16 %

    terra-master · terramaster operating system27 нояб. 2018 г.

  • CVE-2018-12121
    33Наблюдать

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    nodejs · node.js28 нояб. 2018 г.

  • CVE-2018-12122
    42В плане

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial

    ВысокаяCVSS 7,5Эксплойта нетEPSS 41 %

    nodejs · node.js28 нояб. 2018 г.

  • CVE-2018-19627
    35Наблюдать

    In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash.

    ВысокаяCVSS 7,5Proof of conceptEPSS 17 %

    wireshark · wireshark29 нояб. 2018 г.

  • CVE-2018-15979
    33Наблюдать

    Adobe Acrobat and Reader versions 2019.008.20080 and earlier, 2017.011.30105 and earlier, and 2015.006.30456 and earlier have a ntlm sso has

    ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %

    adobe · acrobat dc29 нояб. 2018 г.

  • CVE-2018-15981
    43В плане

    Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability.

    КритическаяCVSS 9,8Эксплойта нетEPSS 11 %

    adobe · flash player desktop runtime29 нояб. 2018 г.

  • CVE-2018-15767
    39Наблюдать

    Improper Authorization Vulnerability

    ВысокаяCVSS 8,8Proof of conceptEPSS 12 %

    dell · openmanage network manager30 нояб. 2018 г.

  • CVE-2018-3948
    37Наблюдать

    An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 23 %

    tp-link · tl-r600vpn firmware30 нояб. 2018 г.

  • CVE-2018-15716
    41В плане

    NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection.

    ВысокаяCVSS 8,8Proof of conceptEPSS 18 %

    nuuo · nvrmini2 firmware30 нояб. 2018 г.

  • CVE-2018-3949
    46В плане

    An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN.

    ВысокаяCVSS 7,5Эксплойта нетEPSS 53 %

    tp-link · tl-r600vpn firmware30 нояб. 2018 г.