По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2019 г.
85 записей · 6 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
43В плане | CVE-2018-14718Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 12,6 % | 2 янв. 2019 г. |
43В плане | CVE-2018-14721Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveragingfasterxml · jackson-databind · CWE-918 | Критическая10,0 | — | 10,4 % | 2 янв. 2019 г. |
42В плане | CVE-2018-19360Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transpfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 10,5 % | 2 янв. 2019 г. |
42В плане | CVE-2018-19361Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clasfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 10,5 % | 2 янв. 2019 г. |
42В плане | CVE-2018-19362Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-commonfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 10,5 % | 2 янв. 2019 г. |
51В плане | CVE-2018-18264Proof of concept | Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within kubernetes · dashboard · CWE-306 | Высокая7,5 | — | 70,3 % | 2 янв. 2019 г. |
43В плане | CVE-2018-19861Proof of concept | Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request.minishare project · minishare · CWE-119 | Критическая9,8 | — | 12,5 % | 3 янв. 2019 г. |
43В плане | CVE-2018-19862Proof of concept | Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request.minishare project · minishare · CWE-119 | Критическая9,8 | — | 12,5 % | 3 янв. 2019 г. |
37Наблюдать | CVE-2019-0538Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · office | Высокая7,8 | — | 20,4 % | 8 янв. 2019 г. |
55В плане | CVE-2019-0539Proof of concept | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Cmicrosoft · chakracore · CWE-787 | Высокая7,5 | — | 82,9 % | 8 янв. 2019 г. |
81Срочно | CVE-2019-0541Готовый эксплойт | A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Exmicrosoft · internet explorer · CWE-77 | Высокая8,8 | KEV | 53,2 % | 8 янв. 2019 г. |
62На этой неделе | CVE-2019-0543Готовый эксплойт | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of microsoft · windows 10 1507 · CWE-287 | Высокая7,8 | KEV | 4,7 % | 8 янв. 2019 г. |
36Наблюдать | CVE-2019-0546Эксплойта нет | A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ construcmicrosoft · visual studio 2017 | Высокая7,8 | — | 16,2 % | 8 янв. 2019 г. |
60На этой неделе | CVE-2019-0547Эксплойта нет | A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akamicrosoft · windows 10 · CWE-787 | Критическая9,8 | — | 71,3 % | 8 янв. 2019 г. |
41В плане | CVE-2019-0566Proof of concept | An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnemicrosoft · edge · CWE-862 | Высокая8,8 | — | 18,6 % | 8 янв. 2019 г. |
54В плане | CVE-2019-0567Proof of concept | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Cmicrosoft · chakracore · CWE-787 | Высокая7,5 | — | 80,1 % | 8 янв. 2019 г. |
51В плане | CVE-2019-0568Proof of concept | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Cmicrosoft · chakracore · CWE-787 | Высокая7,5 | — | 69,4 % | 8 янв. 2019 г. |
36Наблюдать | CVE-2019-0571Proof of concept | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Smicrosoft · windows 10 · CWE-706 | Высокая7,8 | — | 15,8 % | 8 янв. 2019 г. |
39Наблюдать | CVE-2019-0572Proof of concept | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Smicrosoft · windows 10 · CWE-59 | Высокая7,8 | — | 25,1 % | 8 янв. 2019 г. |
37Наблюдать | CVE-2019-0573Proof of concept | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Smicrosoft · windows 10 · CWE-862 | Высокая7,8 | — | 20,1 % | 8 янв. 2019 г. |
37Наблюдать | CVE-2019-0574Proof of concept | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Smicrosoft · windows 10 · CWE-59 | Высокая7,8 | — | 19,4 % | 8 янв. 2019 г. |
35Наблюдать | CVE-2019-0575Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 13,5 % | 8 янв. 2019 г. |
36Наблюдать | CVE-2019-0576Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 17,0 % | 8 янв. 2019 г. |
36Наблюдать | CVE-2019-0577Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 17,2 % | 8 янв. 2019 г. |
35Наблюдать | CVE-2019-0578Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 13,5 % | 8 янв. 2019 г. |
36Наблюдать | CVE-2019-0579Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 17,2 % | 8 янв. 2019 г. |
36Наблюдать | CVE-2019-0580Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 17,2 % | 8 янв. 2019 г. |
35Наблюдать | CVE-2019-0581Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 13,5 % | 8 янв. 2019 г. |
35Наблюдать | CVE-2019-0582Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · office | Высокая7,8 | — | 12,3 % | 8 янв. 2019 г. |
36Наблюдать | CVE-2019-0583Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 16,0 % | 8 янв. 2019 г. |
35Наблюдать | CVE-2019-0584Эксплойта нет | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Enmicrosoft · windows 10 | Высокая7,8 | — | 13,5 % | 8 янв. 2019 г. |
42В плане | CVE-2019-0585Эксплойта нет | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Wmicrosoft · office | Высокая8,8 | — | 21,9 % | 8 янв. 2019 г. |
44В плане | CVE-2019-0586Эксплойта нет | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akmicrosoft · exchange server · CWE-787 | Критическая9,8 | — | 15,3 % | 8 янв. 2019 г. |
38Наблюдать | CVE-2016-9651Proof of concept | A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to egoogle · chrome · CWE-94 | Высокая8,8 | — | 11,1 % | 9 янв. 2019 г. |
40В плане | CVE-2017-15428Proof of concept | Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior google · chrome · CWE-125 | Высокая8,8 | — | 18,1 % | 9 янв. 2019 г. |
61На этой неделе | CVE-2018-16167Proof of concept | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.jpcert · logontracer · CWE-78 | Критическая9,8 | — | 74,9 % | 9 янв. 2019 г. |
46В плане | CVE-2019-5893Proof of concept | Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.nelson-it · open source erp · CWE-89 | Критическая9,8 | — | 24,7 % | 10 янв. 2019 г. |
40В плане | CVE-2018-4404Готовый эксплойт | In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.apple · iphone os · CWE-119 | Высокая8,8 | — | 14,0 % | 11 янв. 2019 г. |
40В плане | CVE-2017-18357Готовый эксплойт | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllshopware · shopware · CWE-610 | Средняя6,5 | — | 27,0 % | 15 янв. 2019 г. |
30Наблюдать | CVE-2019-6442Proof of concept | An issue was discovered in NTPsec before 1.1.3.ntpsec · ntpsec · CWE-787 | Средняя6,5 | — | 13,7 % | 16 янв. 2019 г. |
56В плане | CVE-2019-6443Proof of concept | An issue was discovered in NTPsec before 1.1.3.ntpsec · ntpsec · CWE-125 | Критическая9,1 | — | 66,8 % | 16 янв. 2019 г. |
50В плане | CVE-2019-6444Proof of concept | An issue was discovered in NTPsec before 1.1.3.ntpsec · ntpsec · CWE-125 | Критическая9,1 | — | 45,7 % | 16 янв. 2019 г. |
30Наблюдать | CVE-2019-6445Proof of concept | An issue was discovered in NTPsec before 1.1.3.ntpsec · ntpsec · CWE-476 | Средняя6,5 | — | 14,0 % | 16 янв. 2019 г. |
44В плане | CVE-2019-6446Proof of concept | An issue was discovered in NumPy before 1.16.3.numpy · numpy · CWE-502 | Критическая9,8 | — | 17,5 % | 16 янв. 2019 г. |
51В плане | CVE-2019-6447Готовый эксплойт | The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute appliestrongs · es file explorer file manager · CWE-306 | Высокая8,1 | — | 63,7 % | 16 янв. 2019 г. |
28Наблюдать | CVE-2017-3135Эксплойта нет | Combination of DNS64 and RPZ Can Lead to Crashisc · bind · CWE-476 | Средняя5,9 | — | 17,2 % | 16 янв. 2019 г. |
26Наблюдать | CVE-2017-3136Эксплойта нет | An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"isc · bind · CWE-617 | Средняя5,9 | — | 11,1 % | 16 янв. 2019 г. |
27Наблюдать | CVE-2017-3140Эксплойта нет | An error processing RPZ rules can cause named to loop endlessly after handling a queryisc · bind · CWE-400 | Средняя5,9 | — | 12,2 % | 16 янв. 2019 г. |
28Наблюдать | CVE-2017-3143Proof of concept | An error in TSIG authentication can permit unauthorized dynamic updatesisc · bind | Средняя5,9 | — | 18,2 % | 16 янв. 2019 г. |
52В плане | CVE-2017-3144Эксплойта нет | Failure to properly clean up closed OMAPI connections can exhaust available socketsisc · dhcp · CWE-400 | Высокая7,5 | — | 72,7 % | 16 янв. 2019 г. |
38Наблюдать | CVE-2017-3145Эксплойта нет | Improper fetch cleanup sequencing in the resolver can cause named to crashisc · bind · CWE-416 | Высокая7,5 | — | 27,9 % | 16 янв. 2019 г. |
36Наблюдать | CVE-2018-5733Эксплойта нет | A malicious client can overflow a reference counter in ISC dhcpdisc · dhcp · CWE-190 | Высокая7,5 | — | 20,2 % | 16 янв. 2019 г. |
26Наблюдать | CVE-2018-5736Эксплойта нет | An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attemisc · bind · CWE-617 | Средняя5,3 | — | 18,0 % | 16 янв. 2019 г. |
33Наблюдать | CVE-2018-5737Эксплойта нет | BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.isc · bind · CWE-617 | Высокая7,5 | — | 10,4 % | 16 янв. 2019 г. |
33Наблюдать | CVE-2018-5738Эксплойта нет | Some versions of BIND can improperly permit recursive query service to unauthorized clientsisc · bind · CWE-200 | Высокая7,5 | — | 11,1 % | 16 янв. 2019 г. |
48В плане | CVE-2018-5740Proof of concept | A flaw in the "deny-answer-aliases" feature can cause an assertion failure in namedisc · bind · CWE-617 | Высокая7,5 | — | 59,6 % | 16 янв. 2019 г. |
40В плане | CVE-2018-20735Готовый эксплойт | An issue was discovered in BMC PATROL Agent through 11.3.01.bmc · patrol agent · CWE-287 | Высокая7,8 | — | 7,4 % | 17 янв. 2019 г. |
51В плане | CVE-2018-16042Эксплойта нет | Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earadobe · acrobat dc · CWE-347 | Средняя6,5 | — | 82,4 % | 18 янв. 2019 г. |
88Срочно | CVE-2018-15982Готовый эксплойт | Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.adobe · flash player · CWE-416 | Высокая7,8 | KEV | 89,5 % | 18 янв. 2019 г. |
65На этой неделе | CVE-2019-1003000Готовый эксплойт | A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbjenkins · script security | Высокая8,8 | — | 98,3 % | 22 янв. 2019 г. |
61На этой неделе | CVE-2019-1003001Готовый эксплойт | A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlojenkins · pipeline\ | Высокая8,8 | — | 86,0 % | 22 янв. 2019 г. |
59В плане | CVE-2019-1003002Готовый эксплойт | A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenjenkins · pipeline\ | Высокая8,8 | — | 81,3 % | 22 янв. 2019 г. |
50В плане | CVE-2019-6339Proof of concept | PHAR stream wrapper Arbitrary PHP code executiondrupal · drupal · CWE-20 | Критическая9,8 | — | 35,5 % | 22 янв. 2019 г. |
58В плане | CVE-2018-13374Готовый эксплойт | A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtfortinet · fortiadc · CWE-732 | Средняя4,3 | KEV | 38,0 % | 22 янв. 2019 г. |
35Наблюдать | CVE-2019-6706Proof of concept | Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c.lua · lua · CWE-416 | Высокая7,5 | — | 17,3 % | 23 янв. 2019 г. |
45В плане | CVE-2019-1636Эксплойта нет | Cisco Webex Teams URI Handler Insecure Library Loading Vulnerabilitycisco · webex teams · CWE-78 | Высокая7,8 | — | 46,8 % | 23 янв. 2019 г. |
33Наблюдать | CVE-2018-17686Эксплойта нет | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.2.0.9297.foxitsoftware · phantompdf · CWE-125 | Средняя6,5 | — | 24,3 % | 24 янв. 2019 г. |
87Срочно | CVE-2019-1652Готовый эксплойт | Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerabilitycisco · rv320 firmware · CWE-20 | Высокая7,2 | KEV | 95,9 % | 24 янв. 2019 г. |
90Срочно | CVE-2019-1653Готовый эксплойт | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerabilitycisco · rv320 firmware · CWE-284 | Высокая7,5 | KEV | 99,8 % | 24 янв. 2019 г. |
27Наблюдать | CVE-2019-6799Proof of concept | An issue was discovered in phpMyAdmin before 4.8.5.phpmyadmin · phpmyadmin | Средняя5,9 | — | 14,8 % | 26 янв. 2019 г. |
47В плане | CVE-2019-6703Proof of concept | Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthcalmar-webmedia · total donations | Критическая9,8 | — | 26,0 % | 26 янв. 2019 г. |
56В плане | CVE-2019-6977Proof of concept | gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.libgd · libgd · CWE-787 | Высокая8,8 | — | 71,4 % | 26 янв. 2019 г. |
36Наблюдать | CVE-2019-3462Proof of concept | Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by adebian · advanced package tool | Высокая8,1 | — | 14,5 % | 28 янв. 2019 г. |
64На этой неделе | CVE-2018-17431Proof of concept | Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.comodo · unified threat management firewall · CWE-287 | Критическая9,8 | — | 83,9 % | 30 янв. 2019 г. |
27Наблюдать | CVE-2018-17189Эксплойта нет | In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that reapache · http server · CWE-400 | Средняя5,3 | — | 20,0 % | 30 янв. 2019 г. |
36Наблюдать | CVE-2018-17199Эксплойта нет | In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session.apache · http server · CWE-384 | Высокая7,5 | — | 20,1 % | 30 янв. 2019 г. |
42В плане | CVE-2018-3956Эксплойта нет | An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader versfoxitsoftware · phantompdf · CWE-125 | Высокая7,1 | — | 46,0 % | 30 янв. 2019 г. |
48В плане | CVE-2019-0190Эксплойта нет | A bug exists in the way mod_ssl handled client renegotiations.apache · http server | Высокая7,5 | — | 59,0 % | 30 янв. 2019 г. |
47В плане | CVE-2018-15517Proof of concept | The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actdlink · central wifimanager · CWE-918 | Высокая8,6 | — | 44,1 % | 31 янв. 2019 г. |
25Наблюдать | CVE-2018-19040Proof of concept | The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocatmedia file manager project · media file manager · CWE-22 | Средняя5,3 | — | 12,1 % | 31 янв. 2019 г. |
24Наблюдать | CVE-2018-19042Proof of concept | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to pamedia file manager project · media file manager · CWE-22 | Средняя5,3 | — | 10,0 % | 31 янв. 2019 г. |
24Наблюдать | CVE-2018-19043Proof of concept | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directorymedia file manager project · media file manager · CWE-22 | Средняя5,3 | — | 10,0 % | 31 янв. 2019 г. |
43В плане | CVE-2019-7297Эксплойта нет | An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03.d-link · dir-823g firmware · CWE-78 | Критическая9,8 | — | 12,4 % | 31 янв. 2019 г. |
34Наблюдать | CVE-2019-6110Proof of concept | In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) openbsd · openssh · CWE-838 | Средняя6,8 | — | 24,9 % | 31 янв. 2019 г. |
40В плане | CVE-2019-6111Proof of concept | An issue was discovered in OpenSSH 7.9.openbsd · openssh · CWE-22 | Средняя5,9 | — | 58,2 % | 31 янв. 2019 г. |
- CVE-2018-1471843В плане
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1472143В плане
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging
КритическаяCVSS 10,0Эксплойта нетEPSS 10 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1936042В плане
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transp
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1936142В плане
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clas
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1936242В плане
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1826451В плане
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within
ВысокаяCVSS 7,5Proof of conceptEPSS 70 %kubernetes · dashboard2 янв. 2019 г.
- CVE-2018-1986143В плане
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request.
КритическаяCVSS 9,8Proof of conceptEPSS 12 %minishare project · minishare3 янв. 2019 г.
- CVE-2018-1986243В плане
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request.
КритическаяCVSS 9,8Proof of conceptEPSS 12 %minishare project · minishare3 янв. 2019 г.
- CVE-2019-053837Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 20 %microsoft · office8 янв. 2019 г.
- CVE-2019-053955В плане
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C
ВысокаяCVSS 7,5Proof of conceptEPSS 82 %microsoft · chakracore8 янв. 2019 г.
- CVE-2019-054181Срочно
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Ex
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 53 %microsoft · internet explorer8 янв. 2019 г.
- CVE-2019-054362На этой неделе
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 4 %microsoft · windows 10 15078 янв. 2019 г.
- CVE-2019-054636Наблюдать
A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ construc
ВысокаяCVSS 7,8Эксплойта нетEPSS 16 %microsoft · visual studio 20178 янв. 2019 г.
- CVE-2019-054760На этой неделе
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka
КритическаяCVSS 9,8Эксплойта нетEPSS 71 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-056641В плане
An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulne
ВысокаяCVSS 8,8Proof of conceptEPSS 18 %microsoft · edge8 янв. 2019 г.
- CVE-2019-056754В плане
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C
ВысокаяCVSS 7,5Proof of conceptEPSS 80 %microsoft · chakracore8 янв. 2019 г.
- CVE-2019-056851В плане
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C
ВысокаяCVSS 7,5Proof of conceptEPSS 69 %microsoft · chakracore8 янв. 2019 г.
- CVE-2019-057136Наблюдать
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S
ВысокаяCVSS 7,8Proof of conceptEPSS 15 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057239Наблюдать
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S
ВысокаяCVSS 7,8Proof of conceptEPSS 25 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057337Наблюдать
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S
ВысокаяCVSS 7,8Proof of conceptEPSS 20 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057437Наблюдать
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data S
ВысокаяCVSS 7,8Proof of conceptEPSS 19 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057535Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 13 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057636Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057736Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057835Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 13 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-057936Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-058036Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-058135Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 13 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-058235Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 12 %microsoft · office8 янв. 2019 г.
- CVE-2019-058336Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 16 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-058435Наблюдать
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En
ВысокаяCVSS 7,8Эксплойта нетEPSS 13 %microsoft · windows 108 янв. 2019 г.
- CVE-2019-058542В плане
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft W
ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %microsoft · office8 янв. 2019 г.
- CVE-2019-058644В плане
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak
КритическаяCVSS 9,8Эксплойта нетEPSS 15 %microsoft · exchange server8 янв. 2019 г.
- CVE-2016-965138Наблюдать
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to e
ВысокаяCVSS 8,8Proof of conceptEPSS 11 %google · chrome9 янв. 2019 г.
- CVE-2017-1542840В плане
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior
ВысокаяCVSS 8,8Proof of conceptEPSS 18 %google · chrome9 янв. 2019 г.
- CVE-2018-1616761На этой неделе
LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
КритическаяCVSS 9,8Proof of conceptEPSS 74 %jpcert · logontracer9 янв. 2019 г.
- CVE-2019-589346В плане
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 24 %nelson-it · open source erp10 янв. 2019 г.
- CVE-2018-440440В плане
In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.
ВысокаяCVSS 8,8Готовый эксплойтEPSS 14 %apple · iphone os11 янв. 2019 г.
- CVE-2017-1835740В плане
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controll
СредняяCVSS 6,5Готовый эксплойтEPSS 27 %shopware · shopware15 янв. 2019 г.
- CVE-2019-644230Наблюдать
An issue was discovered in NTPsec before 1.1.3.
СредняяCVSS 6,5Proof of conceptEPSS 13 %ntpsec · ntpsec16 янв. 2019 г.
- CVE-2019-644356В плане
An issue was discovered in NTPsec before 1.1.3.
КритическаяCVSS 9,1Proof of conceptEPSS 66 %ntpsec · ntpsec16 янв. 2019 г.
- CVE-2019-644450В плане
An issue was discovered in NTPsec before 1.1.3.
КритическаяCVSS 9,1Proof of conceptEPSS 45 %ntpsec · ntpsec16 янв. 2019 г.
- CVE-2019-644530Наблюдать
An issue was discovered in NTPsec before 1.1.3.
СредняяCVSS 6,5Proof of conceptEPSS 14 %ntpsec · ntpsec16 янв. 2019 г.
- CVE-2019-644644В плане
An issue was discovered in NumPy before 1.16.3.
КритическаяCVSS 9,8Proof of conceptEPSS 17 %numpy · numpy16 янв. 2019 г.
- CVE-2019-644751В плане
The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute appli
ВысокаяCVSS 8,1Готовый эксплойтEPSS 63 %estrongs · es file explorer file manager16 янв. 2019 г.
- CVE-2017-313528Наблюдать
Combination of DNS64 and RPZ Can Lead to Crash
СредняяCVSS 5,9Эксплойта нетEPSS 17 %isc · bind16 янв. 2019 г.
- CVE-2017-313626Наблюдать
An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"
СредняяCVSS 5,9Эксплойта нетEPSS 11 %isc · bind16 янв. 2019 г.
- CVE-2017-314027Наблюдать
An error processing RPZ rules can cause named to loop endlessly after handling a query
СредняяCVSS 5,9Эксплойта нетEPSS 12 %isc · bind16 янв. 2019 г.
- CVE-2017-314328Наблюдать
An error in TSIG authentication can permit unauthorized dynamic updates
СредняяCVSS 5,9Proof of conceptEPSS 18 %isc · bind16 янв. 2019 г.
- CVE-2017-314452В плане
Failure to properly clean up closed OMAPI connections can exhaust available sockets
ВысокаяCVSS 7,5Эксплойта нетEPSS 72 %isc · dhcp16 янв. 2019 г.
- CVE-2017-314538Наблюдать
Improper fetch cleanup sequencing in the resolver can cause named to crash
ВысокаяCVSS 7,5Эксплойта нетEPSS 27 %isc · bind16 янв. 2019 г.
- CVE-2018-573336Наблюдать
A malicious client can overflow a reference counter in ISC dhcpd
ВысокаяCVSS 7,5Эксплойта нетEPSS 20 %isc · dhcp16 янв. 2019 г.
- CVE-2018-573626Наблюдать
An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attem
СредняяCVSS 5,3Эксплойта нетEPSS 18 %isc · bind16 янв. 2019 г.
- CVE-2018-573733Наблюдать
BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %isc · bind16 янв. 2019 г.
- CVE-2018-573833Наблюдать
Some versions of BIND can improperly permit recursive query service to unauthorized clients
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %isc · bind16 янв. 2019 г.
- CVE-2018-574048В плане
A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named
ВысокаяCVSS 7,5Proof of conceptEPSS 59 %isc · bind16 янв. 2019 г.
- CVE-2018-2073540В плане
An issue was discovered in BMC PATROL Agent through 11.3.01.
ВысокаяCVSS 7,8Готовый эксплойтEPSS 7 %bmc · patrol agent17 янв. 2019 г.
- CVE-2018-1604251В плане
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear
СредняяCVSS 6,5Эксплойта нетEPSS 82 %adobe · acrobat dc18 янв. 2019 г.
- CVE-2018-1598288Срочно
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 89 %adobe · flash player18 янв. 2019 г.
- CVE-2019-100300065На этой неделе
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandb
ВысокаяCVSS 8,8Готовый эксплойтEPSS 98 %jenkins · script security22 янв. 2019 г.
- CVE-2019-100300161На этой неделе
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlo
ВысокаяCVSS 8,8Готовый эксплойтEPSS 86 %jenkins · pipeline\22 янв. 2019 г.
- CVE-2019-100300259В плане
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jen
ВысокаяCVSS 8,8Готовый эксплойтEPSS 81 %jenkins · pipeline\22 янв. 2019 г.
- CVE-2019-633950В плане
PHAR stream wrapper Arbitrary PHP code execution
КритическаяCVSS 9,8Proof of conceptEPSS 35 %drupal · drupal22 янв. 2019 г.
- CVE-2018-1337458В плане
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obt
СредняяCVSS 4,3KEVГотовый эксплойтEPSS 38 %fortinet · fortiadc22 янв. 2019 г.
- CVE-2019-670635Наблюдать
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c.
ВысокаяCVSS 7,5Proof of conceptEPSS 17 %lua · lua23 янв. 2019 г.
- CVE-2019-163645В плане
Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
ВысокаяCVSS 7,8Эксплойта нетEPSS 46 %cisco · webex teams23 янв. 2019 г.
- CVE-2018-1768633Наблюдать
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.2.0.9297.
СредняяCVSS 6,5Эксплойта нетEPSS 24 %foxitsoftware · phantompdf24 янв. 2019 г.
- CVE-2019-165287Срочно
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 95 %cisco · rv320 firmware24 янв. 2019 г.
- CVE-2019-165390Срочно
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 99 %cisco · rv320 firmware24 янв. 2019 г.
- CVE-2019-679927Наблюдать
An issue was discovered in phpMyAdmin before 4.8.5.
СредняяCVSS 5,9Proof of conceptEPSS 14 %phpmyadmin · phpmyadmin26 янв. 2019 г.
- CVE-2019-670347В плане
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauth
КритическаяCVSS 9,8Proof of conceptEPSS 26 %calmar-webmedia · total donations26 янв. 2019 г.
- CVE-2019-697756В плане
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.
ВысокаяCVSS 8,8Proof of conceptEPSS 71 %libgd · libgd26 янв. 2019 г.
- CVE-2019-346236Наблюдать
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a
ВысокаяCVSS 8,1Proof of conceptEPSS 14 %debian · advanced package tool28 янв. 2019 г.
- CVE-2018-1743164На этой неделе
Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.
КритическаяCVSS 9,8Proof of conceptEPSS 83 %comodo · unified threat management firewall30 янв. 2019 г.
- CVE-2018-1718927Наблюдать
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that re
СредняяCVSS 5,3Эксплойта нетEPSS 20 %apache · http server30 янв. 2019 г.
- CVE-2018-1719936Наблюдать
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session.
ВысокаяCVSS 7,5Эксплойта нетEPSS 20 %apache · http server30 янв. 2019 г.
- CVE-2018-395642В плане
An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader vers
ВысокаяCVSS 7,1Эксплойта нетEPSS 46 %foxitsoftware · phantompdf30 янв. 2019 г.
- CVE-2019-019048В плане
A bug exists in the way mod_ssl handled client renegotiations.
ВысокаяCVSS 7,5Эксплойта нетEPSS 59 %apache · http server30 янв. 2019 г.
- CVE-2018-1551747В плане
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but act
ВысокаяCVSS 8,6Proof of conceptEPSS 44 %dlink · central wifimanager31 янв. 2019 г.
- CVE-2018-1904025Наблюдать
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocat
СредняяCVSS 5,3Proof of conceptEPSS 12 %media file manager project · media file manager31 янв. 2019 г.
- CVE-2018-1904224Наблюдать
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to pa
СредняяCVSS 5,3Proof of conceptEPSS 10 %media file manager project · media file manager31 янв. 2019 г.
- CVE-2018-1904324Наблюдать
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory
СредняяCVSS 5,3Proof of conceptEPSS 10 %media file manager project · media file manager31 янв. 2019 г.
- CVE-2019-729743В плане
An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03.
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %d-link · dir-823g firmware31 янв. 2019 г.
- CVE-2019-611034Наблюдать
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker)
СредняяCVSS 6,8Proof of conceptEPSS 24 %openbsd · openssh31 янв. 2019 г.
- CVE-2019-611140В плане
An issue was discovered in OpenSSH 7.9.
СредняяCVSS 5,9Proof of conceptEPSS 58 %openbsd · openssh31 янв. 2019 г.