İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2018: sömürülen ve yeni ciddi CVE kayıtları

82 kayıt · 3 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2018-16323
    41Planlayın

    ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel v

    OrtaCVSS 6,5Kavram kanıtıEPSS %49

    imagemagick · imagemagick1 Eyl 2018

  • CVE-2018-16509
    59Planlayın

    An issue was discovered in Artifex Ghostscript before 9.24.

    YüksekCVSS 7,8SilahlaştırılmışEPSS %92

    artifex · ghostscript5 Eyl 2018

  • CVE-2018-14618
    42Planlayın

    curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code.

    KritikCVSS 9,8İstismar yokEPSS %11

    haxx · libcurl5 Eyl 2018

  • CVE-2015-9266
    61Bu hafta

    Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload

    KritikCVSS 9,8SilahlaştırılmışEPSS %73

    ui · airmax ac firmware5 Eyl 2018

  • CVE-2018-16144
    49Planlayın

    The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command in

    KritikCVSS 9,8İstismar yokEPSS %32

    opsview · opsview5 Eyl 2018

  • CVE-2018-5391
    40Planlayın

    The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets

    YüksekCVSS 7,5Kavram kanıtıEPSS %32

    linux · linux kernel6 Eyl 2018

  • CVE-2018-1756
    33İzleyin

    IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection.

    YüksekCVSS 7,5Kavram kanıtıEPSS %10

    ibm · security identity governance and intelligence7 Eyl 2018

  • CVE-2018-16059
    30İzleyin

    Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.

    OrtaCVSS 5,3Kavram kanıtıEPSS %29

    endress · wirelesshart fieldgate swg70 firmware7 Eyl 2018

  • CVE-2018-16763
    64Bu hafta

    FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %82

    thedaylightstudio · fuel cms9 Eyl 2018

  • CVE-2018-16836
    57Planlayın

    Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and exe

    KritikCVSS 9,8Kavram kanıtıEPSS %61

    rubedo project · rubedo11 Eyl 2018

  • CVE-2017-1084
    35İzleyin

    In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard

    YüksekCVSS 7,5Kavram kanıtıEPSS %15

    freebsd · freebsd12 Eyl 2018

  • CVE-2018-7921
    30İzleyin

    Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability.

    OrtaCVSS 6,5Kavram kanıtıEPSS %13

    huawei · b315s-22 firmware12 Eyl 2018

  • CVE-2018-8269
    38İzleyin

    A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." Th

    YüksekCVSS 7,5Kavram kanıtıEPSS %26

    microsoft · microsoft.data.odata12 Eyl 2018

  • CVE-2018-8331
    37İzleyin

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    YüksekCVSS 7,8İstismar yokEPSS %19

    microsoft · excel12 Eyl 2018

  • CVE-2018-8332
    41Planlayın

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Win32k

    YüksekCVSS 8,8İstismar yokEPSS %19

    microsoft · office12 Eyl 2018

  • CVE-2018-8354
    34İzleyin

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · chakracore12 Eyl 2018

  • CVE-2018-8367
    34İzleyin

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · chakracore12 Eyl 2018

  • CVE-2018-8391
    33İzleyin

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

    YüksekCVSS 7,5İstismar yokEPSS %11

    microsoft · chakracore12 Eyl 2018

  • CVE-2018-8392
    38İzleyin

    A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, ak

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · windows 1012 Eyl 2018

  • CVE-2018-8393
    38İzleyin

    A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, ak

    YüksekCVSS 7,8İstismar yokEPSS %22

    microsoft · windows 1012 Eyl 2018

  • CVE-2018-8420
    50Planlayın

    A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code

    YüksekCVSS 8,8Kavram kanıtıEPSS %48

    microsoft · windows 1012 Eyl 2018

  • CVE-2018-8421
    48Planlayın

    A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execut

    KritikCVSS 9,8İstismar yokEPSS %29

    microsoft · .net framework12 Eyl 2018

  • CVE-2018-8424
    30İzleyin

    An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows

    OrtaCVSS 6,5İstismar yokEPSS %12

    microsoft · windows 1012 Eyl 2018

  • CVE-2018-8429
    26İzleyin

    An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel In

    OrtaCVSS 5,5İstismar yokEPSS %12

    microsoft · excel12 Eyl 2018

  • CVE-2018-8430
    38İzleyin

    A remote code execution vulnerability exists in Microsoft Word if a user opens a specially crafted PDF file, aka "Word PDF Remote Code Execu

    YüksekCVSS 7,8İstismar yokEPSS %23

    microsoft · office12 Eyl 2018

  • CVE-2018-8440
    67Bu hafta

    An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows A

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %18

    microsoft · windows 10 160712 Eyl 2018

  • CVE-2018-8447
    34İzleyin

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    YüksekCVSS 7,5İstismar yokEPSS %12

    microsoft · internet explorer12 Eyl 2018

  • CVE-2018-8456
    34İzleyin

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · chakracore12 Eyl 2018

  • CVE-2018-8457
    34İzleyin

    A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · internet explorer12 Eyl 2018

  • CVE-2018-8459
    34İzleyin

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge12 Eyl 2018

  • CVE-2018-8461
    34İzleyin

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    YüksekCVSS 7,5İstismar yokEPSS %12

    microsoft · internet explorer12 Eyl 2018

  • CVE-2018-8463
    34İzleyin

    An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the

    YüksekCVSS 7,4Kavram kanıtıEPSS %15

    microsoft · edge12 Eyl 2018

  • CVE-2018-8464
    43Planlayın

    An remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge PDF R

    YüksekCVSS 7,5İstismar yokEPSS %42

    microsoft · edge12 Eyl 2018

  • CVE-2018-8465
    34İzleyin

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5İstismar yokEPSS %14

    microsoft · edge12 Eyl 2018

  • CVE-2018-8466
    51Planlayın

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5Kavram kanıtıEPSS %69

    microsoft · chakracore12 Eyl 2018

  • CVE-2018-8467
    51Planlayın

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5Kavram kanıtıEPSS %69

    microsoft · chakracore12 Eyl 2018

  • CVE-2018-8468
    22İzleyin

    An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability."

    OrtaCVSS 4,7Kavram kanıtıEPSS %11

    microsoft · windows 1012 Eyl 2018

  • CVE-2018-8469
    34İzleyin

    An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the

    YüksekCVSS 7,4Kavram kanıtıEPSS %15

    microsoft · edge12 Eyl 2018

  • CVE-2018-8474
    41Planlayın

    A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for M

    YüksekCVSS 7,5Kavram kanıtıEPSS %38

    microsoft · lync for mac12 Eyl 2018

  • CVE-2018-8475
    40Planlayın

    A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code E

    YüksekCVSS 8,8İstismar yokEPSS %15

    microsoft · windows 1012 Eyl 2018

  • CVE-2018-17057
    47Planlayın

    An issue was discovered in TCPDF before 6.2.22.

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    tecnick · tcpdf14 Eyl 2018

  • CVE-2018-10814
    31İzleyin

    Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.

    YüksekCVSS 7,8Kavram kanıtıEPSS %1

    synametrics · synaman14 Eyl 2018

  • CVE-2018-12086
    34İzleyin

    Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.

    YüksekCVSS 7,5Kavram kanıtıEPSS %11

    opcfoundation · unified architecture-.net-legacy14 Eyl 2018

  • CVE-2018-16286
    45Planlayın

    LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the P

    KritikCVSS 9,8İstismar yokEPSS %21

    lg · supersign cms14 Eyl 2018

  • CVE-2018-16287
    45Planlayın

    LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs.

    KritikCVSS 9,8İstismar yokEPSS %19

    lg · supersign cms14 Eyl 2018

  • CVE-2018-16288
    45Planlayın

    LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.

    YüksekCVSS 8,6Kavram kanıtıEPSS %35

    lg · supersign cms14 Eyl 2018

  • CVE-2018-16706
    37İzleyin

    LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 90

    YüksekCVSS 7,5Kavram kanıtıEPSS %22

    lg · supersign cms14 Eyl 2018

  • CVE-2018-17128
    43Planlayın

    A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.

    OrtaCVSS 5,4Kavram kanıtıEPSS %74

    mybb · mybb17 Eyl 2018

  • CVE-2018-11780
    42Planlayın

    A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

    KritikCVSS 9,8İstismar yokEPSS %10

    apache · spamassassin17 Eyl 2018

  • CVE-2018-17153
    65Bu hafta

    It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability.

    KritikCVSS 9,8SilahlaştırılmışEPSS %86

    western digital · my cloud wdbctl0020hwt firmware18 Eyl 2018

  • CVE-2018-16670
    28İzleyin

    An issue was discovered in CIRCONTROL CirCarLife before 4.3.

    OrtaCVSS 5,3Kavram kanıtıEPSS %24

    circontrol · circarlife scada18 Eyl 2018

  • CVE-2018-1000802
    45Planlayın

    Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    python · python18 Eyl 2018

  • CVE-2018-1149
    44Planlayın

    cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.

    KritikCVSS 9,8İstismar yokEPSS %15

    nuuo · nvrmini2 firmware19 Eyl 2018

  • CVE-2018-17207
    60Bu hafta

    An issue was discovered in Snap Creek Duplicator before 1.2.42.

    KritikCVSS 9,8SilahlaştırılmışEPSS %60

    awesomemotive · duplicator19 Eyl 2018

  • CVE-2018-17243
    62Bu hafta

    Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.

    KritikCVSS 9,8İstismar yokEPSS %75

    zohocorp · manageengine opmanager20 Eyl 2018

  • CVE-2018-17254
    64Bu hafta

    The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %82

    arkextensions · jck editor20 Eyl 2018

  • CVE-2018-14829
    44Planlayın

    Rockwell Automation RSLinx Classic Versions 4.00.01 and prior.

    KritikCVSS 9,8İstismar yokEPSS %16

    rockwellautomation · rslinx20 Eyl 2018

  • CVE-2018-16752
    48Planlayın

    LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feat

    YüksekCVSS 8,8İstismar yokEPSS %42

    linknet-usa · lw-n605r firmware20 Eyl 2018

  • CVE-2018-17283
    50Planlayın

    Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /opu

    YüksekCVSS 7,5Kavram kanıtıEPSS %66

    zohocorp · manageengine opmanager20 Eyl 2018

  • CVE-2018-16793
    37İzleyin

    Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/log

    YüksekCVSS 8,6İstismar yokEPSS %11

    microsoft · exchange server21 Eyl 2018

  • CVE-2018-16833
    44Planlayın

    Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI.

    OrtaCVSS 6,1İstismar yokEPSS %65

    zohocorp · manageengine desktop central21 Eyl 2018

  • CVE-2018-17173
    56Planlayın

    LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.

    KritikCVSS 9,8Kavram kanıtıEPSS %56

    lg · supersign cms21 Eyl 2018

  • CVE-2018-16283
    58Planlayın

    The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    wechat brodcast project · wechat brodcast24 Eyl 2018

  • CVE-2018-16299
    43Planlayın

    The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.

    YüksekCVSS 7,5Kavram kanıtıEPSS %44

    localize my post project · localize my post24 Eyl 2018

  • CVE-2018-17281
    46Planlayın

    There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x

    YüksekCVSS 7,5İstismar yokEPSS %52

    digium · asterisk24 Eyl 2018

  • CVE-2018-14647
    33İzleyin

    Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.

    YüksekCVSS 7,5İstismar yokEPSS %10

    python · python25 Eyl 2018

  • CVE-2018-12840
    39İzleyin

    Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun

    YüksekCVSS 7,5İstismar yokEPSS %28

    adobe · acrobat dc25 Eyl 2018

  • CVE-2018-12848
    49Planlayın

    Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun

    KritikCVSS 9,8İstismar yokEPSS %34

    adobe · acrobat dc25 Eyl 2018

  • CVE-2018-12849
    40Planlayın

    Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun

    YüksekCVSS 7,5İstismar yokEPSS %33

    adobe · acrobat dc25 Eyl 2018

  • CVE-2018-12850
    40Planlayın

    Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-boun

    YüksekCVSS 7,5İstismar yokEPSS %33

    adobe · acrobat dc25 Eyl 2018

  • CVE-2018-15957
    47Planlayın

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru

    KritikCVSS 9,8İstismar yokEPSS %28

    adobe · coldfusion25 Eyl 2018

  • CVE-2018-15958
    47Planlayın

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru

    KritikCVSS 9,8İstismar yokEPSS %25

    adobe · coldfusion25 Eyl 2018

  • CVE-2018-15959
    47Planlayın

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru

    KritikCVSS 9,8İstismar yokEPSS %25

    adobe · coldfusion25 Eyl 2018

  • CVE-2018-15961
    99Hemen

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploa

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    adobe · coldfusion25 Eyl 2018

  • CVE-2018-15965
    47Planlayın

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru

    KritikCVSS 9,8İstismar yokEPSS %25

    adobe · coldfusion25 Eyl 2018

  • CVE-2018-11763
    38İzleyin

    In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU

    OrtaCVSS 5,9İstismar yokEPSS %50

    apache · http server25 Eyl 2018

  • CVE-2018-14634
    65Bu hafta

    An integer overflow flaw was found in the Linux kernel's create_elf_tables() function.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %14

    linux · linux kernel25 Eyl 2018

  • CVE-2018-16364
    37İzleyin

    A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a

    YüksekCVSS 8,1İstismar yokEPSS %17

    zohocorp · manageengine applications manager26 Eyl 2018

  • CVE-2018-15531
    47Planlayın

    JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

    KritikCVSS 9,8İstismar yokEPSS %27

    javamelody project · javamelody26 Eyl 2018

  • CVE-2018-16055
    38İzleyin

    An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to

    YüksekCVSS 8,8İstismar yokEPSS %11

    netgate · pfsense26 Eyl 2018

  • CVE-2018-17613
    39İzleyin

    Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCK

    KritikCVSS 9,8İstismar yokEPSS %1

    telegram · telegram desktop28 Eyl 2018

  • CVE-2018-5393
    43Planlayın

    TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authentication

    KritikCVSS 9,8İstismar yokEPSS %12

    tp-link · eap controller28 Eyl 2018