Archive
November 2018
Vulnerabilities first published in this month (UTC), newest first.
986 results · Feed
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Microsoft RemoteFX Virtual GPU miniport driver handl…
-
Unscored —
An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings con…
-
Unscored —
A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to…
-
Unscored —
A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanit…
-
Unscored —
A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanit…
-
High 7.5CVE-2018-8541 EPSS 14%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Unscored —
A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Fede…
-
High 7.5CVE-2018-8555 EPSS 14%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5CVE-2018-8551 EPSS 14%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Unscored —
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevatio…
-
Unscored —CVE-2018-8550 Public exploit
An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerabil…
-
Unscored —
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "W…
-
Unscored —
An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializ…
-
High 7.5CVE-2018-8556 EPSS 14%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Unscored —CVE-2018-8584 Public exploit
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (…
-
Unscored —
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevatio…
-
Unscored —
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially …
-
Unscored —
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Window…
-
Unscored —
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
-
Unscored —
A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard…
-
Unscored —CVE-2018-8570 EPSS 14%
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Interne…
-
Unscored —CVE-2018-8574 EPSS 19%
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obj…
-
Unscored —CVE-2018-8539 EPSS 19%
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in mem…
-
Medium 5.4
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially …
-
Unscored —
An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, a…
-
High 7.5CVE-2018-8588 EPSS 14%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Medium 6.5
Tampering vulnerability in .NET Core
A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.
-
Unscored —CVE-2018-8573 EPSS 19%
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in mem…
-
Unscored —CVE-2018-8576 EPSS 19%
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in …
-
Unscored —CVE-2018-8575 EPSS 20%
A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in …
-
Unscored —
A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code, aka "Microsoft Po…
-
Unscored —
An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Informat…
-
Unscored —
An information disclosure vulnerability exists when attaching files to Outlook messages, aka "Microsoft Outlook Informa…
-
High 7.5
Rack vulnerable to Denial of Service
There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
-
Medium 6.1
Rack vulnerable to Cross-site Scripting
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape …
-
Unscored —
VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper author…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Losant Arduino MQTT…
-
High 8.8
Path Traversal in Hadoop
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
-
Unscored —
SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: Wh…
-
Unscored —
In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a tran…