Archive

January 2018

Vulnerabilities first published in this month (UTC), newest first.

← December 2017 2018 / January February 2018 →

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

Critical 9.8

CVE-2017-1000353 Exploited Public exploit EPSS 100%

Deserialization of Untrusted Data in Jenkins

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the…

org.jenkins-ci.main:jenkins-core Maven

Jan 29, 2018
KEV Oct 2, 2025
Critical 9.8

CVE-2017-17485 Public exploit EPSS 50%

jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readVa…

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Jan 10, 2018
Critical 9.8

CVE-2017-8046 Public exploit Scanner template EPSS 75%

Remote code execution in PATCH requests in Spring Data REST

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Pivotal Pivotal Spring Data REST and Spring Boot org.springframework.data:spring-data-rest-core Maven

Jan 4, 2018
Critical 9.8

CVE-2017-1000486 Exploited Public exploit Scanner template EPSS 94%

Inadequate Encryption Strength

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

org.primefaces:primefaces Maven

Jan 3, 2018
KEV Jan 10, 2022
Critical 9.8

CVE-2017-1000487 Public exploit

OS Command Injection in Plexus-utils

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

plexus-utils2 org.codehaus.plexus:plexus-utils plexus-utils2 plexus-utils Debian Ubuntu Maven

Jan 3, 2018