İçeriğe atla
Noroxi

Yayın tarihine göre

Mart 2018: sömürülen ve yeni ciddi CVE kayıtları

114 kayıt · 22 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 2

  • CVE-2018-2380
    65Bu hafta

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thu

    OrtaCVSS 6,6KEVSilahlaştırılmışEPSS %28

    sap · customer relationship management1 Mar 2018

  • CVE-2018-7573
    60Bu hafta

    An issue was discovered in FTPShell Client 6.7.

    KritikCVSS 9,8SilahlaştırılmışEPSS %69

    ftpshell · ftpshell client1 Mar 2018

  • CVE-2018-7584
    65Bu hafta

    In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while pa

    KritikCVSS 9,8Kavram kanıtıEPSS %87

    php · php1 Mar 2018

  • CVE-2017-14461
    33İzleyin

    A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensi

    YüksekCVSS 7,1İstismar yokEPSS %16

    dovecot · dovecot2 Mar 2018

  • CVE-2018-1058
    39İzleyin

    A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.

    YüksekCVSS 8,8Kavram kanıtıEPSS %13

    postgresql · postgresql2 Mar 2018

  • CVE-2018-7583
    41Planlayın

    Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.

    YüksekCVSS 7,5Kavram kanıtıEPSS %38

    advantig · dualdesk3 Mar 2018

  • CVE-2018-7662
    35İzleyin

    Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpm

    OrtaCVSS 5,3Kavram kanıtıEPSS %47

    couchcms · couch4 Mar 2018

  • CVE-2018-7665
    60Bu hafta

    An issue was discovered in ClipBucket before 4.0.0 Release 4902.

    KritikCVSS 9,8SilahlaştırılmışEPSS %15

    clip-bucket · clipbucket5 Mar 2018

  • CVE-2018-1000115
    60Bu hafta

    Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP

    YüksekCVSS 7,5SilahlaştırılmışEPSS %88

    memcached · memcached5 Mar 2018

  • CVE-2018-0491
    34İzleyin

    A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10.

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    torproject · tor5 Mar 2018

  • CVE-2017-17428
    60Bu hafta

    Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leve

    OrtaCVSS 5,9SilahlaştırılmışEPSS %14

    cavium · nitrox ssl sdk5 Mar 2018

  • CVE-2015-5377
    43Planlayın

    Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    elastic · elasticsearch6 Mar 2018

  • CVE-2018-6530
    98Hemen

    OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %96

    dlink · dir-860l firmware6 Mar 2018

  • CVE-2018-7182
    39İzleyin

    The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via

    YüksekCVSS 7,5Kavram kanıtıEPSS %28

    ntp · ntp6 Mar 2018

  • CVE-2018-7739
    55Planlayın

    antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters,

    KritikCVSS 9,8Kavram kanıtıEPSS %53

    antsle · antman6 Mar 2018

  • CVE-2018-7745
    34İzleyin

    An issue was discovered in Western Bridge Cobub Razor 0.7.2.

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    cobub · razor7 Mar 2018

  • CVE-2017-15367
    46Planlayın

    Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database

    KritikCVSS 9,8Kavram kanıtıEPSS %23

    bacula · bacula-web7 Mar 2018

  • CVE-2018-0147
    74Bu hafta

    A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthe

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %18

    cisco · secure access control system8 Mar 2018

  • CVE-2018-1216
    45Planlayın

    A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enab

    KritikCVSS 9,8İstismar yokEPSS %21

    dell · emc solutions enabler virtual appliance8 Mar 2018

  • CVE-2018-7183
    42Planlayın

    Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by lever

    KritikCVSS 9,8İstismar yokEPSS %10

    ntp · ntp8 Mar 2018

  • CVE-2018-7890
    63Bu hafta

    A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640).

    KritikCVSS 9,8SilahlaştırılmışEPSS %78

    zohocorp · manageengine applications manager8 Mar 2018

  • CVE-2018-7582
    41Planlayın

    WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.

    YüksekCVSS 7,5Kavram kanıtıEPSS %36

    weblogexpert · weblog expert9 Mar 2018

  • CVE-2018-8056
    34İzleyin

    Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/manage/channel/addchan

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    cobub · razor11 Mar 2018

  • CVE-2018-8057
    46Planlayın

    A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/

    KritikCVSS 9,8Kavram kanıtıEPSS %21

    westernbridgegroup · razor11 Mar 2018

  • CVE-2018-8065
    60Bu hafta

    An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %75

    flexense · syncbreeze12 Mar 2018

  • CVE-2017-2619
    33İzleyin

    Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the serv

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    samba · samba12 Mar 2018

  • CVE-2018-1323
    44Planlayın

    The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to

    YüksekCVSS 7,5Kavram kanıtıEPSS %46

    apache · tomcat jk connector12 Mar 2018

  • CVE-2018-1000094
    40Planlayın

    CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admi

    YüksekCVSS 7,2SilahlaştırılmışEPSS %38

    cmsmadesimple · cms made simple12 Mar 2018

  • CVE-2018-1057
    38İzleyin

    On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LD

    YüksekCVSS 8,8İstismar yokEPSS %10

    samba · samba13 Mar 2018

  • CVE-2017-1002101
    42Planlayın

    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with

    KritikCVSS 9,6Kavram kanıtıEPSS %12

    kubernetes · kubernetes13 Mar 2018

  • CVE-2018-7750
    47Planlayın

    transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    paramiko · paramiko13 Mar 2018

  • CVE-2018-8096
    53Planlayın

    Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticatione

    KritikCVSS 9,8Kavram kanıtıEPSS %48

    datalust · seq13 Mar 2018

  • CVE-2018-1000129
    31İzleyin

    An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript i

    OrtaCVSS 6,1Kavram kanıtıEPSS %24

    jolokia · jolokia14 Mar 2018

  • CVE-2018-1000130
    54Planlayın

    A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java c

    YüksekCVSS 8,1Kavram kanıtıEPSS %73

    jolokia · webarchive agent14 Mar 2018

  • CVE-2018-5782
    45Planlayın

    A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    mitel · connect onsite14 Mar 2018

  • CVE-2018-0872
    35İzleyin

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Mar 2018

  • CVE-2018-0873
    35İzleyin

    ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to h

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Mar 2018

  • CVE-2018-0874
    35İzleyin

    ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, du

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Mar 2018

  • CVE-2018-0876
    35İzleyin

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Mar 2018

  • CVE-2018-0878
    18İzleyin

    Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2

    DüşükCVSS 3,1Kavram kanıtıEPSS %21

    microsoft · windows 1014 Mar 2018

  • CVE-2018-0883
    34İzleyin

    Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · windows 1014 Mar 2018

  • CVE-2018-0886
    53Planlayın

    The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and

    YüksekCVSS 7,0Kavram kanıtıEPSS %81

    microsoft · windows 1014 Mar 2018

  • CVE-2018-0889
    35İzleyin

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · internet explorer14 Mar 2018

  • CVE-2018-0891
    21İzleyin

    ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server

    OrtaCVSS 4,3Kavram kanıtıEPSS %14

    microsoft · internet explorer14 Mar 2018

  • CVE-2018-0893
    38İzleyin

    Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en

    YüksekCVSS 7,5İstismar yokEPSS %26

    microsoft · edge14 Mar 2018

  • CVE-2018-0903
    36İzleyin

    Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code exec

    YüksekCVSS 7,8İstismar yokEPSS %15

    microsoft · access14 Mar 2018

  • CVE-2018-0919
    16İzleyin

    Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2

    DüşükCVSS 3,3İstismar yokEPSS %11

    microsoft · office14 Mar 2018

  • CVE-2018-0922
    36İzleyin

    Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibil

    YüksekCVSS 7,8İstismar yokEPSS %17

    microsoft · office14 Mar 2018

  • CVE-2018-0925
    33İzleyin

    ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory

    YüksekCVSS 7,5İstismar yokEPSS %11

    microsoft · chakracore14 Mar 2018

  • CVE-2018-0930
    33İzleyin

    ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles obje

    YüksekCVSS 7,5İstismar yokEPSS %11

    microsoft · edge14 Mar 2018

  • CVE-2018-0931
    33İzleyin

    ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr

    YüksekCVSS 7,5İstismar yokEPSS %11

    microsoft · edge14 Mar 2018

  • CVE-2018-0933
    50Planlayın

    ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr

    YüksekCVSS 7,5Kavram kanıtıEPSS %66

    microsoft · edge14 Mar 2018

  • CVE-2018-0934
    50Planlayın

    ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakr

    YüksekCVSS 7,5Kavram kanıtıEPSS %66

    microsoft · edge14 Mar 2018

  • CVE-2018-0935
    47Planlayın

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi

    YüksekCVSS 7,5Kavram kanıtıEPSS %55

    microsoft · internet explorer14 Mar 2018

  • CVE-2018-0936
    35İzleyin

    ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Mar 2018

  • CVE-2018-0937
    35İzleyin

    ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in mem

    YüksekCVSS 7,5İstismar yokEPSS %15

    microsoft · edge14 Mar 2018

  • CVE-2018-0941
    26İzleyin

    Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vu

    OrtaCVSS 5,5İstismar yokEPSS %12

    microsoft · exchange server14 Mar 2018

  • CVE-2018-1000120
    42Planlayın

    A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of se

    KritikCVSS 9,8İstismar yokEPSS %11

    debian · debian linux14 Mar 2018

  • CVE-2018-6328
    60Bu hafta

    It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allo

    KritikCVSS 9,8SilahlaştırılmışEPSS %64

    kaseya · unitrends backup14 Mar 2018

  • CVE-2018-6329
    60Bu hafta

    It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a

    KritikCVSS 9,8SilahlaştırılmışEPSS %61

    unitrends · backup14 Mar 2018

  • CVE-2018-7702
    40Planlayın

    SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to ar

    KritikCVSS 9,1Kavram kanıtıEPSS %13

    securenvoy · securmail14 Mar 2018

  • CVE-2018-7756
    57Planlayın

    RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which al

    KritikCVSS 9,8Kavram kanıtıEPSS %60

    dewesoft · dewesoft14 Mar 2018

  • CVE-2018-8045
    43Planlayın

    In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User

    YüksekCVSS 8,8Kavram kanıtıEPSS %28

    joomla · joomla\!14 Mar 2018

  • CVE-2018-8715
    39İzleyin

    The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c.

    YüksekCVSS 8,1Kavram kanıtıEPSS %22

    embedthis · appweb14 Mar 2018

  • CVE-2018-6223
    42Planlayın

    A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to man

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    trendmicro · email encryption gateway15 Mar 2018

  • CVE-2018-6228
    42Planlayın

    A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    trendmicro · email encryption gateway15 Mar 2018

  • CVE-2018-6229
    42Planlayın

    A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL comma

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    trendmicro · email encryption gateway15 Mar 2018

  • CVE-2018-8770
    39İzleyin

    Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.

    OrtaCVSS 5,3Kavram kanıtıEPSS %59

    cobub · razor18 Mar 2018

  • CVE-2018-7422
    49Planlayın

    A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil

    YüksekCVSS 7,5Kavram kanıtıEPSS %62

    siteeditor · site editor19 Mar 2018

  • CVE-2018-1218
    35İzleyin

    In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    dell · emc networker19 Mar 2018

  • CVE-2014-2674
    35İzleyin

    Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    ajax-pagination project · ajax-pagination19 Mar 2018

  • CVE-2018-7445
    87Hemen

    A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %60

    mikrotik · routeros19 Mar 2018

  • CVE-2017-17215
    58Planlayın

    Huawei HG532 with some customized versions has a remote code execution vulnerability.

    YüksekCVSS 8,8Kavram kanıtıEPSS %78

    huawei · hg532 firmware20 Mar 2018

  • CVE-2018-8088
    43Planlayın

    org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restric

    KritikCVSS 9,8İstismar yokEPSS %14

    qos · slf4j20 Mar 2018

  • CVE-2018-1321
    33İzleyin

    An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1

    YüksekCVSS 7,2Kavram kanıtıEPSS %17

    apache · syncope20 Mar 2018

  • CVE-2018-1322
    25İzleyin

    An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and

    OrtaCVSS 4,9Kavram kanıtıEPSS %19

    apache · syncope20 Mar 2018

  • CVE-2018-8828
    48Planlayın

    A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2.

    KritikCVSS 9,8İstismar yokEPSS %30

    kamailio · kamailio20 Mar 2018

  • CVE-2018-1207
    66Bu hafta

    Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code.

    KritikCVSS 9,8Kavram kanıtıEPSS %90

    dell · emc idrac723 Mar 2018

  • CVE-2017-17736
    60Bu hafta

    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/insta

    KritikCVSS 9,8Kavram kanıtıEPSS %68

    kentico · xperience23 Mar 2018

  • CVE-2018-7719
    44Planlayın

    Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %46

    acrolinx · acrolinx server25 Mar 2018

  • CVE-2018-8947
    33İzleyin

    rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attack

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    laravel log viewer project · laravel log viewer25 Mar 2018

  • CVE-2017-15710
    35İzleyin

    In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the

    YüksekCVSS 7,5İstismar yokEPSS %17

    apache · http server26 Mar 2018

  • CVE-2017-15715
    58Planlayın

    In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, ra

    YüksekCVSS 8,1Kavram kanıtıEPSS %85

    apache · http server26 Mar 2018

  • CVE-2018-1301
    27İzleyin

    A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size li

    OrtaCVSS 5,9İstismar yokEPSS %14

    apache · http server26 Mar 2018

  • CVE-2018-1302
    27İzleyin

    When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer po

    OrtaCVSS 5,9İstismar yokEPSS %12

    apache · http server26 Mar 2018

  • CVE-2018-1303
    51Planlayın

    A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while

    YüksekCVSS 7,5İstismar yokEPSS %69

    apache · http server26 Mar 2018

  • CVE-2018-1312
    44Planlayın

    In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not co

    KritikCVSS 9,8İstismar yokEPSS %15

    apache · http server26 Mar 2018

  • CVE-2018-1189
    27İzleyin

    Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affe

    OrtaCVSS 4,8Kavram kanıtıEPSS %27

    dell · emc isilon26 Mar 2018

  • CVE-2018-7658
    42Planlayın

    NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by s

    YüksekCVSS 7,5Kavram kanıtıEPSS %38

    softros · network time system26 Mar 2018

  • CVE-2018-9032
    47Planlayın

    An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmwar

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    dlink · dir-850l firmware26 Mar 2018

  • CVE-2017-12319
    60Bu hafta

    A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow a

    OrtaCVSS 5,9KEVSilahlaştırılmışEPSS %5

    cisco · ios27 Mar 2018

  • CVE-2018-7700
    57Planlayın

    DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify

    YüksekCVSS 8,8Kavram kanıtıEPSS %74

    dedecms · dedecms27 Mar 2018

  • CVE-2018-6882
    63Bu hafta

    Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %29

    synacor · zimbra collaboration suite27 Mar 2018

  • CVE-2018-0739
    32İzleyin

    Constructed ASN.1 types with a recursive definition could exceed the stack

    OrtaCVSS 6,5İstismar yokEPSS %18

    openssl · openssl27 Mar 2018

  • CVE-2018-8823
    54Planlayın

    modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 thro

    KritikCVSS 9,8Kavram kanıtıEPSS %50

    prestashop · prestashop27 Mar 2018

  • CVE-2018-0151
    73Bu hafta

    A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, re

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %14

    cisco · ios xe28 Mar 2018

  • CVE-2018-0154
    62Bu hafta

    A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an una

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Mar 2018

  • CVE-2018-0155
    66Bu hafta

    A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Cata

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Mar 2018

  • CVE-2018-0156
    63Bu hafta

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %9

    cisco · ios28 Mar 2018

  • CVE-2018-0158
    66Bu hafta

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthe

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %7

    cisco · ios28 Mar 2018