İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2018: sömürülen ve yeni ciddi CVE kayıtları

73 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2018-19788
    38İzleyin

    A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl co

    YüksekCVSS 8,8Kavram kanıtıEPSS %11

    polkit project · polkit3 Ara 2018

  • CVE-2018-16855
    48Planlayın

    An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds m

    YüksekCVSS 7,5İstismar yokEPSS %58

    powerdns · recursor3 Ara 2018

  • CVE-2018-7114
    49Planlayın

    HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code ex

    KritikCVSS 9,8İstismar yokEPSS %32

    hp · intelligent management center3 Ara 2018

  • CVE-2018-7115
    25İzleyin

    HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001

    OrtaCVSS 5,3İstismar yokEPSS %13

    hp · intelligent management center3 Ara 2018

  • CVE-2018-7116
    33İzleyin

    HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote denial of service via dbman Opcode 10003

    YüksekCVSS 7,5İstismar yokEPSS %10

    hp · intelligent management center3 Ara 2018

  • CVE-2018-14699
    48Planlayın

    System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker

    KritikCVSS 9,8Kavram kanıtıEPSS %29

    drobo · 5n2 firmware3 Ara 2018

  • CVE-2018-14701
    45Planlayın

    System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker

    KritikCVSS 9,8İstismar yokEPSS %19

    drobo · 5n2 firmware3 Ara 2018

  • CVE-2018-14706
    44Planlayın

    System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attac

    KritikCVSS 9,8İstismar yokEPSS %17

    drobo · 5n2 firmware3 Ara 2018

  • CVE-2018-14707
    38İzleyin

    Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload f

    YüksekCVSS 7,5İstismar yokEPSS %27

    drobo · 5n2 firmware3 Ara 2018

  • CVE-2018-4019
    43Planlayın

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POS

    YüksekCVSS 7,2İstismar yokEPSS %48

    netgate · pfsense3 Ara 2018

  • CVE-2018-4020
    43Planlayın

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POS

    YüksekCVSS 7,2İstismar yokEPSS %48

    netgate · pfsense3 Ara 2018

  • CVE-2018-4021
    50Planlayın

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POS

    YüksekCVSS 7,2İstismar yokEPSS %72

    netgate · pfsense3 Ara 2018

  • CVE-2018-17157
    46Planlayın

    In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by s

    KritikCVSS 9,8İstismar yokEPSS %24

    freebsd · freebsd4 Ara 2018

  • CVE-2018-19864
    46Planlayın

    NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (

    KritikCVSS 9,8Kavram kanıtıEPSS %24

    nuuo · nvrmini2 firmware5 Ara 2018

  • CVE-2018-1002105
    65Bu hafta

    In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the

    KritikCVSS 9,8Kavram kanıtıEPSS %86

    kubernetes · kubernetes5 Ara 2018

  • CVE-2018-19877
    30İzleyin

    login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.

    OrtaCVSS 6,1Kavram kanıtıEPSS %18

    adiscon · loganalyzer5 Ara 2018

  • CVE-2018-18312
    43Planlayın

    Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

    KritikCVSS 9,8İstismar yokEPSS %12

    perl · perl5 Ara 2018

  • CVE-2018-19753
    35İzleyin

    Tarantella Enterprise before 3.11 allows Directory Traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %16

    oracle · tarantella enterprise5 Ara 2018

  • CVE-2018-19908
    40Planlayın

    An issue was discovered in MISP 2.4.9x before 2.4.99.

    YüksekCVSS 8,8Kavram kanıtıEPSS %17

    misp-project · misp6 Ara 2018

  • CVE-2018-19660
    44Planlayın

    An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmw

    YüksekCVSS 8,8İstismar yokEPSS %28

    moxa · nport w2x50a firmware6 Ara 2018

  • CVE-2018-7364
    42Planlayın

    All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability.

    KritikCVSS 9,8İstismar yokEPSS %10

    zte · zxin107 Ara 2018

  • CVE-2018-18311
    43Planlayın

    Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

    KritikCVSS 9,8İstismar yokEPSS %11

    perl · perl7 Ara 2018

  • CVE-2018-1000861
    98Hemen

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/cor

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    jenkins · jenkins10 Ara 2018

  • CVE-2018-17480
    76Bu hafta

    Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.35

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %35

    google · chrome11 Ara 2018

  • CVE-2018-20062
    99Hemen

    An issue was discovered in NoneCms V1.3.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    5none · nonecms11 Ara 2018

  • CVE-2018-10143
    46Planlayın

    The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system

    KritikCVSS 9,8İstismar yokEPSS %24

    paloaltonetworks · expedition11 Ara 2018

  • CVE-2018-8540
    45Planlayın

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote

    KritikCVSS 9,8İstismar yokEPSS %21

    microsoft · .net framework11 Ara 2018

  • CVE-2018-8583
    33İzleyin

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · chakracore11 Ara 2018

  • CVE-2018-8587
    40Planlayın

    A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsof

    YüksekCVSS 7,8Kavram kanıtıEPSS %28

    microsoft · office11 Ara 2018

  • CVE-2018-8597
    36İzleyin

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · excel11 Ara 2018

  • CVE-2018-8611
    62Bu hafta

    An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Eleva

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %4

    microsoft · windows 10 160711 Ara 2018

  • CVE-2018-8617
    49Planlayın

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5Kavram kanıtıEPSS %62

    microsoft · chakracore11 Ara 2018

  • CVE-2018-8618
    33İzleyin

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5İstismar yokEPSS %10

    microsoft · chakracore11 Ara 2018

  • CVE-2018-8619
    43Planlayın

    A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under

    YüksekCVSS 7,5Kavram kanıtıEPSS %44

    microsoft · internet explorer11 Ara 2018

  • CVE-2018-8624
    34İzleyin

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · chakracore11 Ara 2018

  • CVE-2018-8625
    43Planlayın

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Rem

    YüksekCVSS 7,5Kavram kanıtıEPSS %43

    microsoft · internet explorer11 Ara 2018

  • CVE-2018-8626
    45Planlayın

    A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Wi

    KritikCVSS 9,8İstismar yokEPSS %21

    microsoft · windows 1011 Ara 2018

  • CVE-2018-8628
    36İzleyin

    A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory,

    YüksekCVSS 7,8İstismar yokEPSS %15

    microsoft · office11 Ara 2018

  • CVE-2018-8629
    37İzleyin

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

    YüksekCVSS 7,5İstismar yokEPSS %22

    microsoft · chakracore11 Ara 2018

  • CVE-2018-8631
    51Planlayın

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor

    YüksekCVSS 7,5Kavram kanıtıEPSS %68

    microsoft · internet explorer11 Ara 2018

  • CVE-2018-8634
    40Planlayın

    A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory, aka "

    YüksekCVSS 8,8İstismar yokEPSS %15

    microsoft · windows 1011 Ara 2018

  • CVE-2018-8636
    36İzleyin

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "

    YüksekCVSS 7,8İstismar yokEPSS %16

    microsoft · excel11 Ara 2018

  • CVE-2018-8639
    68Bu hafta

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %22

    microsoft · windows 10 150711 Ara 2018

  • CVE-2018-8033
    38İzleyin

    In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP serv

    YüksekCVSS 7,5Kavram kanıtıEPSS %25

    apache · ofbiz13 Ara 2018

  • CVE-2018-1821
    41Planlayın

    IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processin

    KritikCVSS 9,1Kavram kanıtıEPSS %15

    ibm · operational decision manager13 Ara 2018

  • CVE-2018-19439
    30İzleyin

    XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4).

    OrtaCVSS 6,1Kavram kanıtıEPSS %20

    oracle · secure global desktop13 Ara 2018

  • CVE-2018-16873
    52Planlayın

    In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and

    YüksekCVSS 8,1İstismar yokEPSS %66

    golang · go14 Ara 2018

  • CVE-2018-18006
    45Planlayın

    Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myP

    KritikCVSS 9,8İstismar yokEPSS %21

    ricoh · myprint14 Ara 2018

  • CVE-2018-20148
    47Planlayın

    In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMedi

    KritikCVSS 9,8Kavram kanıtıEPSS %26

    wordpress · wordpress14 Ara 2018

  • CVE-2018-20173
    46Planlayın

    Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.

    KritikCVSS 9,8İstismar yokEPSS %24

    zohocorp · manageengine opmanager17 Ara 2018

  • CVE-2018-18556
    44Planlayın

    A privilege escalation issue was discovered in VyOS 1.1.8.

    KritikCVSS 9,9SilahlaştırılmışEPSS %15

    vyos · vyos17 Ara 2018

  • CVE-2018-15126
    43Planlayın

    LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer ext

    KritikCVSS 9,8İstismar yokEPSS %11

    libvnc project · libvncserver19 Ara 2018

  • CVE-2018-15127
    44Planlayın

    LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer

    KritikCVSS 9,8İstismar yokEPSS %15

    libvnc project · libvncserver19 Ara 2018

  • CVE-2018-6307
    40Planlayın

    LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer ext

    YüksekCVSS 8,1İstismar yokEPSS %26

    libvnc project · libvncserver19 Ara 2018

  • CVE-2018-8653
    69Bu hafta

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %29

    microsoft · internet explorer20 Ara 2018

  • CVE-2018-1000811
    49Planlayın

    bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can res

    YüksekCVSS 8,8Kavram kanıtıEPSS %47

    bludit · bludit20 Ara 2018

  • CVE-2018-1160
    65Bu hafta

    Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.

    KritikCVSS 9,8Kavram kanıtıEPSS %86

    netatalk · netatalk20 Ara 2018

  • CVE-2018-17246
    64Bu hafta

    Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin.

    KritikCVSS 9,8Kavram kanıtıEPSS %82

    elastic · kibana20 Ara 2018

  • CVE-2018-20338
    42Planlayın

    Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.

    KritikCVSS 9,8İstismar yokEPSS %11

    zohocorp · manageengine opmanager21 Ara 2018

  • CVE-2018-20346
    35İzleyin

    SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries th

    YüksekCVSS 8,1İstismar yokEPSS %10

    sqlite · sqlite21 Ara 2018

  • CVE-2018-19320
    62Bu hafta

    The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26,

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    gigabyte · aorus graphics engine21 Ara 2018

  • CVE-2018-19321
    62Bu hafta

    The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    gigabyte · aorus graphics engine21 Ara 2018

  • CVE-2018-19322
    62Bu hafta

    The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    gigabyte · aorus graphics engine21 Ara 2018

  • CVE-2018-19323
    72Bu hafta

    The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26,

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %8

    gigabyte · aorus graphics engine21 Ara 2018

  • CVE-2018-7836
    49Planlayın

    An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could a

    KritikCVSS 9,8İstismar yokEPSS %31

    schneider-electric · iiot monitor24 Ara 2018

  • CVE-2018-20247
    47Planlayın

    In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree

    YüksekCVSS 7,8İstismar yokEPSS %54

    foxitsoftware · quick pdf library24 Ara 2018

  • CVE-2018-20463
    34İzleyin

    An issue was discovered in the JSmol2WP plugin 1.07 for WordPress.

    YüksekCVSS 7,5Kavram kanıtıEPSS %13

    jsmol2wp project · jsmol2wp25 Ara 2018

  • CVE-2018-11741
    44Planlayın

    NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId

    KritikCVSS 9,8Kavram kanıtıEPSS %17

    nec · univerge sv9100 webpro firmware26 Ara 2018

  • CVE-2018-11742
    43Planlayın

    NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.

    KritikCVSS 9,8Kavram kanıtıEPSS %14

    nec · univerge sv9100 webpro firmware26 Ara 2018

  • CVE-2018-19616
    41Planlayın

    An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000.

    YüksekCVSS 8,1Kavram kanıtıEPSS %30

    rockwellautomation · powermonitor 1000 firmware26 Ara 2018

  • CVE-2018-1000888
    41Planlayın

    PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class.

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    php · pear archive tar28 Ara 2018

  • CVE-2018-20608
    34İzleyin

    imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    txjia · imcat30 Ara 2018

  • CVE-2018-6341
    25İzleyin

    React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.

    OrtaCVSS 6,1Kavram kanıtıEPSS %3

    facebook · react31 Ara 2018