İçeriğe atla
Noroxi

Yayın tarihine göre

Haziran 2018: sömürülen ve yeni ciddi CVE kayıtları

99 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2018-11646
    60Bu hafta

    webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebK

    YüksekCVSS 7,5SilahlaştırılmışEPSS %68

    webkitgtk · webkitgtk\+1 Haz 2018

  • CVE-2018-11652
    46Planlayın

    CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HT

    KritikCVSS 9,8Kavram kanıtıEPSS %23

    cirt.net · nikto1 Haz 2018

  • CVE-2018-11552
    32İzleyin

    There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field.

    OrtaCVSS 6,1İstismar yokEPSS %28

    nch · axon pbx1 Haz 2018

  • CVE-2018-11538
    39İzleyin

    servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSR

    YüksekCVSS 8,8Kavram kanıtıEPSS %12

    searchblox · searchblox1 Haz 2018

  • CVE-2018-11143
    50Planlayın

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).

    KritikCVSS 9,8İstismar yokEPSS %36

    quest · disk backup1 Haz 2018

  • CVE-2018-10613
    35İzleyin

    Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and

    YüksekCVSS 7,5İstismar yokEPSS %17

    ge · mds pulsenet4 Haz 2018

  • CVE-2018-11714
    59Planlayın

    An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0

    KritikCVSS 9,8Kavram kanıtıEPSS %67

    tp-link · tl-wr840n firmware4 Haz 2018

  • CVE-2018-11586
    43Planlayın

    XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files o

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    searchblox · searchblox5 Haz 2018

  • CVE-2017-16082
    42Planlayın

    A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    node-postgres · pg6 Haz 2018

  • CVE-2017-16086
    60Bu hafta

    ua-parser is a port of Browserscope's user agent parser.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %9

    ua-parser project · ua-parser6 Haz 2018

  • CVE-2018-0296
    90Hemen

    A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    cisco · adaptive security appliance software7 Haz 2018

  • CVE-2018-12031
    45Planlayın

    Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory t

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    eaton · intelligent power manager7 Haz 2018

  • CVE-2018-3758
    43Planlayın

    Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

    YüksekCVSS 8,8İstismar yokEPSS %27

    express-cart project · express-cart7 Haz 2018

  • CVE-2018-12053
    33İzleyin

    Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using director

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    schools alert management script project · schools alert management script8 Haz 2018

  • CVE-2018-12054
    41Planlayın

    Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %37

    schools alert management script project · schools alert management script8 Haz 2018

  • CVE-2018-10088
    51Planlayın

    Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.

    KritikCVSS 9,8Kavram kanıtıEPSS %39

    xiongmaitech · uc-httpd8 Haz 2018

  • CVE-2018-11409
    60Bu hafta

    Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demon

    OrtaCVSS 5,3SilahlaştırılmışEPSS %98

    splunk · splunk8 Haz 2018

  • CVE-2018-4192
    34İzleyin

    An issue was discovered in certain Apple products.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    apple · safari8 Haz 2018

  • CVE-2018-4222
    38İzleyin

    An issue was discovered in certain Apple products.

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    apple · safari8 Haz 2018

  • CVE-2018-4233
    60Bu hafta

    An issue was discovered in certain Apple products.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %53

    apple · safari8 Haz 2018

  • CVE-2018-4237
    40Planlayın

    An issue was discovered in certain Apple products.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %13

    apple · iphone os8 Haz 2018

  • CVE-2018-4243
    36İzleyin

    An issue was discovered in certain Apple products.

    YüksekCVSS 7,8Kavram kanıtıEPSS %18

    apple · apple tv8 Haz 2018

  • CVE-2016-9066
    34İzleyin

    A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data.

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    mozilla · firefox11 Haz 2018

  • CVE-2016-9079
    86Hemen

    A use-after-free vulnerability in SVG Animation has been discovered.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %87

    debian · debian linux11 Haz 2018

  • CVE-2016-9899
    45Planlayın

    Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    debian · debian linux11 Haz 2018

  • CVE-2017-5375
    49Planlayın

    JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.

    KritikCVSS 9,8Kavram kanıtıEPSS %34

    redhat · enterprise linux desktop11 Haz 2018

  • CVE-2017-5404
    44Planlayın

    A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of

    KritikCVSS 9,8Kavram kanıtıEPSS %16

    debian · debian linux11 Haz 2018

  • CVE-2017-5415
    25İzleyin

    An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion

    OrtaCVSS 5,3Kavram kanıtıEPSS %12

    mozilla · firefox11 Haz 2018

  • CVE-2017-5447
    41Planlayın

    An out-of-bounds read during the processing of glyph widths during text layout.

    KritikCVSS 9,1Kavram kanıtıEPSS %16

    debian · debian linux11 Haz 2018

  • CVE-2017-5465
    41Planlayın

    An out-of-bounds read while processing SVG content in "ConvolvePixel".

    KritikCVSS 9,1Kavram kanıtıEPSS %18

    debian · debian linux11 Haz 2018

  • CVE-2017-7783
    34İzleyin

    If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example.com"), the resultin

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    mozilla · firefox11 Haz 2018

  • CVE-2018-5093
    36İzleyin

    A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially exploitable crash.

    YüksekCVSS 7,5İstismar yokEPSS %19

    mozilla · firefox11 Haz 2018

  • CVE-2018-5094
    34İzleyin

    A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collection on memory that

    YüksekCVSS 7,5İstismar yokEPSS %14

    mozilla · firefox11 Haz 2018

  • CVE-2018-5146
    39İzleyin

    An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    redhat · enterprise linux desktop11 Haz 2018

  • CVE-2018-5158
    38İzleyin

    The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafte

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    debian · debian linux11 Haz 2018

  • CVE-2018-5159
    45Planlayın

    An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possib

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    debian · debian linux11 Haz 2018

  • CVE-2018-6961
    88Hemen

    VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component.

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %85

    vmware · nsx sd-wan by velocloud11 Haz 2018

  • CVE-2018-0732
    45Planlayın

    Client DoS due to large DH parameter

    YüksekCVSS 7,5İstismar yokEPSS %48

    openssl · openssl12 Haz 2018

  • CVE-2018-0978
    35İzleyin

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · internet explorer14 Haz 2018

  • CVE-2018-8110
    35İzleyin

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge14 Haz 2018

  • CVE-2018-8111
    35İzleyin

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge14 Haz 2018

  • CVE-2018-8210
    39İzleyin

    A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution Vulnerabi

    YüksekCVSS 7,8İstismar yokEPSS %25

    microsoft · windows 1014 Haz 2018

  • CVE-2018-8225
    39İzleyin

    A remote code execution vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses,

    YüksekCVSS 8,1İstismar yokEPSS %24

    microsoft · windows 1014 Haz 2018

  • CVE-2018-8226
    34İzleyin

    A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · windows 1014 Haz 2018

  • CVE-2018-8227
    35İzleyin

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · edge14 Haz 2018

  • CVE-2018-8229
    51Planlayın

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5Kavram kanıtıEPSS %70

    microsoft · edge14 Haz 2018

  • CVE-2018-8231
    37İzleyin

    A remote code execution vulnerability exists when HTTP Protocol Stack (Http.sys) improperly handles objects in memory, aka "HTTP Protocol St

    YüksekCVSS 8,1İstismar yokEPSS %16

    microsoft · windows 1014 Haz 2018

  • CVE-2018-8236
    34İzleyin

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge14 Haz 2018

  • CVE-2018-8239
    39İzleyin

    An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows

    OrtaCVSS 5,5İstismar yokEPSS %58

    microsoft · windows 1014 Haz 2018

  • CVE-2018-8243
    34İzleyin

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

    YüksekCVSS 7,5İstismar yokEPSS %12

    microsoft · chakracore14 Haz 2018

  • CVE-2018-8245
    36İzleyin

    A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when i

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · publisher14 Haz 2018

  • CVE-2018-8246
    28İzleyin

    An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In

    OrtaCVSS 5,5İstismar yokEPSS %18

    microsoft · excel14 Haz 2018

  • CVE-2018-8248
    38İzleyin

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    YüksekCVSS 7,8İstismar yokEPSS %21

    microsoft · office14 Haz 2018

  • CVE-2018-8249
    34İzleyin

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · internet explorer14 Haz 2018

  • CVE-2018-8267
    35İzleyin

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    YüksekCVSS 7,5İstismar yokEPSS %16

    microsoft · internet explorer14 Haz 2018

  • CVE-2018-11690
    34İzleyin

    The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper vali

    OrtaCVSS 6,1İstismar yokEPSS %33

    balbooa · gridbox14 Haz 2018

  • CVE-2018-12453
    37İzleyin

    Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-se

    YüksekCVSS 7,5Kavram kanıtıEPSS %23

    redislabs · redis16 Haz 2018

  • CVE-2018-11218
    60Bu hafta

    Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0

    KritikCVSS 9,8SilahlaştırılmışEPSS %59

    redislabs · redis17 Haz 2018

  • CVE-2018-12533
    45Planlayın

    JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbit

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    redhat · richfaces18 Haz 2018

  • CVE-2015-4664
    45Planlayın

    An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    broadcom · privileged access manager18 Haz 2018

  • CVE-2018-1333
    35İzleyin

    DoS for HTTP/2 connections by crafted requests

    YüksekCVSS 7,5İstismar yokEPSS %17

    apache · http server18 Haz 2018

  • CVE-2018-9022
    43Planlayın

    An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code o

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    broadcom · privileged access manager18 Haz 2018

  • CVE-2018-11116
    36İzleyin

    OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call a

    YüksekCVSS 8,8İstismar yokEPSS %2

    openwrt · openwrt19 Haz 2018

  • CVE-2018-12293
    38İzleyin

    The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKit

    YüksekCVSS 8,8Kavram kanıtıEPSS %10

    canonical · ubuntu linux19 Haz 2018

  • CVE-2018-12327
    47Planlayın

    Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher pri

    KritikCVSS 9,8Kavram kanıtıEPSS %28

    ntp · ntp20 Haz 2018

  • CVE-2018-12604
    34İzleyin

    GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    njtech · greencms20 Haz 2018

  • CVE-2018-0301
    44Planlayın

    A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the manag

    KritikCVSS 9,8İstismar yokEPSS %17

    cisco · nx-os20 Haz 2018

  • CVE-2018-12617
    38İzleyin

    qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overfl

    YüksekCVSS 7,5Kavram kanıtıEPSS %25

    qemu · qemu21 Haz 2018

  • CVE-2018-12613
    65Bu hafta

    An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the serve

    YüksekCVSS 8,8SilahlaştırılmışEPSS %98

    phpmyadmin · phpmyadmin21 Haz 2018

  • CVE-2018-12634
    56Planlayın

    CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    circontrol · circarlife scada21 Haz 2018

  • CVE-2018-12636
    37İzleyin

    The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via th

    YüksekCVSS 7,2Kavram kanıtıEPSS %29

    ithemes · security22 Haz 2018

  • CVE-2018-12692
    44Planlayın

    TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell me

    YüksekCVSS 8,8İstismar yokEPSS %28

    tp-link · tl-wa850re firmware23 Haz 2018

  • CVE-2018-12693
    31İzleyin

    Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to cause a

    OrtaCVSS 6,5İstismar yokEPSS %15

    tp-link · tl-wa850re firmware23 Haz 2018

  • CVE-2018-12713
    37İzleyin

    GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demon

    KritikCVSS 9,1İstismar yokEPSS %1

    gimp · gimp24 Haz 2018

  • CVE-2018-10956
    46Planlayın

    IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %54

    ipconfigure · orchid core vms25 Haz 2018

  • CVE-2018-0598
    34İzleyin

    Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker t

    YüksekCVSS 7,8İstismar yokEPSS %10

    microsoft · windows26 Haz 2018

  • CVE-2017-7657
    43Planlayın

    In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled

    KritikCVSS 9,8İstismar yokEPSS %14

    eclipse · jetty26 Haz 2018

  • CVE-2018-1000517
    49Planlayın

    BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Bu

    KritikCVSS 9,8İstismar yokEPSS %32

    busybox · busybox26 Haz 2018

  • CVE-2018-1000528
    38İzleyin

    GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change pa

    OrtaCVSS 6,1İstismar yokEPSS %46

    gonicus · gosa26 Haz 2018

  • CVE-2018-1000533
    61Bu hafta

    klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` functio

    KritikCVSS 9,8SilahlaştırılmışEPSS %72

    gitlist · gitlist26 Haz 2018

  • CVE-2017-7658
    45Planlayın

    In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when pr

    KritikCVSS 9,8İstismar yokEPSS %19

    eclipse · jetty26 Haz 2018

  • CVE-2018-1000600
    62Bu hafta

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java t

    YüksekCVSS 8,8Kavram kanıtıEPSS %90

    jenkins · github26 Haz 2018

  • CVE-2018-10660
    64Bu hafta

    An issue was discovered in multiple models of Axis IP Cameras.

    KritikCVSS 9,8SilahlaştırılmışEPSS %82

    axis · a1001 firmware26 Haz 2018

  • CVE-2018-10661
    65Bu hafta

    An issue was discovered in multiple models of Axis IP Cameras.

    KritikCVSS 9,8SilahlaştırılmışEPSS %86

    axis · a1001 firmware26 Haz 2018

  • CVE-2018-10662
    63Bu hafta

    An issue was discovered in multiple models of Axis IP Cameras.

    KritikCVSS 9,8SilahlaştırılmışEPSS %79

    axis · a1001 firmware26 Haz 2018

  • CVE-2018-3760
    38İzleyin

    There is an information leak vulnerability in Sprockets.

    YüksekCVSS 7,5Kavram kanıtıEPSS %26

    redhat · cloudforms26 Haz 2018

  • CVE-2018-10594
    60Bu hafta

    Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, E

    KritikCVSS 9,8SilahlaştırılmışEPSS %68

    deltaww · commgr26 Haz 2018

  • CVE-2018-12895
    54Planlayın

    WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param

    YüksekCVSS 8,8SilahlaştırılmışEPSS %62

    wordpress · wordpress26 Haz 2018

  • CVE-2018-12900
    43Planlayın

    Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.

    YüksekCVSS 8,8İstismar yokEPSS %25

    libtiff · libtiff26 Haz 2018

  • CVE-2018-12905
    37İzleyin

    joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.

    OrtaCVSS 6,1İstismar yokEPSS %42

    joyplus-cms project · joyplus-cms27 Haz 2018

  • CVE-2018-12908
    42Planlayın

    Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a

    KritikCVSS 9,8Kavram kanıtıEPSS %10

    brynamics · brynamics27 Haz 2018

  • CVE-2018-12909
    35İzleyin

    Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has acc

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    webgrind project · webgrind27 Haz 2018

  • CVE-2018-1306
    43Planlayın

    The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain se

    YüksekCVSS 7,5Kavram kanıtıEPSS %43

    apache · pluto27 Haz 2018

  • CVE-2018-11510
    52Planlayın

    The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cg

    KritikCVSS 9,8Kavram kanıtıEPSS %44

    asustor · adm28 Haz 2018

  • CVE-2018-12589
    37İzleyin

    Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working

    YüksekCVSS 7,8Kavram kanıtıEPSS %20

    polarisoffice · polaris office 201728 Haz 2018

  • CVE-2018-12998
    54Planlayın

    A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manage

    OrtaCVSS 6,1Kavram kanıtıEPSS %99

    zohocorp · firewall analyzer29 Haz 2018

  • CVE-2018-12464
    63Bu hafta

    Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway

    KritikCVSS 9,8SilahlaştırılmışEPSS %80

    microfocus · secure messaging gateway29 Haz 2018

  • CVE-2018-12465
    52Planlayın

    Remote Code Execution in Micro Focus Secure Messaging Gateway

    YüksekCVSS 7,2SilahlaştırılmışEPSS %80

    microfocus · secure messaging gateway29 Haz 2018

  • CVE-2018-10860
    43Planlayın

    perl-archive-zip is vulnerable to a directory traversal in Archive::Zip.

    YüksekCVSS 7,5İstismar yokEPSS %43

    canonical · ubuntu linux29 Haz 2018