Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 13:34Z
2018-04-19
2018-04-19 20:29Z
HIGH

CVE-2018-0231 — Cisco Adaptive_security_appliance_software: A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-0231

A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious TLS message to an interface en CVSSv3.1 8.6 (HIGH) · EPSS 91th percentile

CWECWE 20CWECWE 787VNDCiscoVNDTransportTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2018-04-19
2018-04-19 20:29Z
HIGH

CVE-2018-0230 — Cisco Secure_firewall_threat_defense: A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-0230

A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to the affected software improperly validating IP Version 4 (IPv4) and IP Version 6 (IPv6) packets after the software reassembles the pa CVSSv3.1 8.6 (HIGH) · EPSS 77th percentile

CWECWE 400VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2018-04-19
2018-04-19 20:29Z
HIGH

CVE-2018-0228 — Cisco Adaptive_security_appliance_software: A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-0228

A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the CPU to increase upwards of 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incorrect handling of an internal software lock that could prevent other system processes from getting CPU cycles, causing a high CPU condition. An attacker could exploit this v CVSSv3.1 8.6 (HIGH) · EPSS 88th percentile

CWECWE 20CWECWE 667VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2018-04-16
2018-04-16 18:29Z
MED

CVE-2018-0737 — Openssl Openssl: The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-0737

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o). CVSSv3.1 5.9 (MEDIUM) · EPSS 96th percentile

CWECWE 327VNDCanonicalVNDOpensslTYPVulnerability
5.9
CVSS v3.1
83
Edit Score
2018-04-11
2018-04-11 13:29Z
CRIT

CVE-2018-1273 — Broadcom Spring_data_commons: An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-1273in the wild

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 94VNDApacheVNDBroadcomVNDPivotal SoftwareTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2018-04-06
2018-04-06 13:29Z
CRIT

CVE-2018-1270 — Vmware Spring_framework: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 94CWECWE 358VNDVmwareVNDOracleTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2018-03-27
2018-03-27 17:29Z
HIGH

CVE-2018-7195 — Enhancesoft Osticket: before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-7195

Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number. CVSSv3.1 8.1 (HIGH) · EPSS 59th percentile

VNDEnhancesoftTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2018-03-27
2018-03-27 16:29Z
MED

CVE-2018-6882 — Synacor Zimbra_collaboration_suite: Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-6882in the wild

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. CVSSv3.1 6.1 (MEDIUM) · EPSS 98th percentile

CWECWE 79VNDSynacorVNDXssTYPVulnerabilitySTAitw exploited
6.1
CVSS v3.1
88
Edit Score
2018-02-28
2018-02-28 20:29Z
MED

CVE-2018-1304 — Apache Tomcat: The URL pattern of "" (the empty string) which exactly maps to the context

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-1304

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empt CVSSv3.1 5.9 (MEDIUM) · EPSS 97th percentile

VNDApacheTYPVulnerability
5.9
CVSS v3.1
85
Edit Score
2018-02-26
2018-02-26 15:29Z
CRIT

CVE-2018-7489 — Fasterxml Jackson-databind: before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-7489

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 502CWECWE 184VNDOracleVNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2018-02-23
2018-02-23 23:29Z
MED

CVE-2018-1305 — Apache Tomcat: Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-1305

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authori CVSSv3.1 6.5 (MEDIUM) · EPSS 97th percentile

VNDApacheVNDSecurityTYPVulnerability
6.5
CVSS v3.1
87
Edit Score
2018-02-19
2018-02-19 19:29Z
CRIT

CVE-2017-7376 — Xmlsoft Libxml2: Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7376

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 119VNDGoogleVNDXmlsoftTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2018-02-19
2018-02-19 19:29Z
CRIT

CVE-2017-7375 — Xmlsoft Libxml2: A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable). CVSSv3.1 9.8 (CRITICAL) · EPSS 85th percentile

CWECWE 611VNDXmlsoftTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2018-02-15
2018-02-15 02:29Z
HIGH

CVE-2018-0851 — Microsoft Office: 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-0851

Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852. CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

CWECWE 787VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2018-02-06
2018-02-06 15:29Z
CRIT

CVE-2017-7525 — Fasterxml Jackson-databind: A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7525

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 502CWECWE 184VNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2018-02-06
2018-02-06 15:29Z
CRIT

CVE-2017-15095 — Fasterxml Jackson-databind: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-15095

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 502CWECWE 184VNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2018-01-29
2018-01-29 20:29Z
CRIT

CVE-2018-0101 — Cisco Adaptive_security_appliance_software: A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-0101

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configu CVSSv3.1 10.0 (CRITICAL) · EPSS 100th percentile

CWECWE 415VNDCiscoVNDSecureTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2018-01-22
2018-01-22 04:29Z
HIGH

CVE-2018-5968 — Fasterxml Jackson-databind: through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-5968

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist. CVSSv3.1 8.1 (HIGH) · EPSS 94th percentile

CWECWE 502CWECWE 184VNDFasterxmlTYPVulnerability
8.1
CVSS v3.1
93
Edit Score
2018-01-04
2018-01-04 13:29Z
MED

CVE-2017-5754 — Intel Atom_c: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5754

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. CVSSv3.1 5.6 (MEDIUM) · EPSS 100th percentile

CWECWE 200VNDIntelTYPVulnerability
5.6
CVSS v3.1
100
Edit Score
2018-01-04
2018-01-04 13:29Z
MED

CVE-2017-5753 — Intel Atom_c: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5753

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. CVSSv3.1 5.6 (MEDIUM) · EPSS 100th percentile

CWECWE 203VNDIntelTYPVulnerability
5.6
CVSS v3.1
100
Edit Score
2018-01-04
2018-01-04 06:29Z
CRIT

CVE-2017-8046 — Vmware Spring_boot: Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 20VNDVmwareVNDMaliciousTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-12-11
2017-12-11 06:29Z
HIGH

CVE-2017-17512 — Sensible-utils_project Sensible-utils: sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-17512

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile

CWECWE 74VNDSensible Utils ProjectTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2017-11-23
2017-11-23 21:29Z
CRIT

CVE-2017-16931 — Xmlsoft Libxml2: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 119VNDXmlsoftTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-11-17
2017-11-17 05:29Z
CRIT

CVE-2017-1000158 — Python Python: CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-1000158

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 190VNDCpythonTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-11-16
2017-11-16 21:29Z
HIGH

CVE-2017-16715 — Moxa Nport_5110_firmware: An attacker may be able to exploit a flaw in the handling of Ethernet

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-16715

An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exploit a flaw in the handling of Ethernet frame padding that may allow for information exposure. CVSSv3.1 8.6 (HIGH) · EPSS 48th percentile

CWECWE 200VNDInformationVNDMoxaTYPVulnerability
8.6
CVSS v3.1
93
Edit Score