KEV 2018

'Mutagen Astronomy' — an integer overflow in create_elf_tables() gives local users root on Linux systems dating to 2007

AirLink ALEOS Web Admin Upload Flaw — Executable File Upload on End-of-Life Industrial Routers

Windows Win32k — Kernel Privilege Escalation Added to KEV Years After Original Patch

Paessler PRTG Network Monitor — Authenticated OS Command Injection via the Administrator Web Console

Microsoft Windows — COM Deserialization RCE via Malicious File or Script, Added to KEV Six Years After Patch

If an attacker has the app's APP_KEY, forged encrypted cookies deserialize into remote code execution on Laravel apps

JasperReports Path Traversal — Any Authenticated User Can Read Server Configuration Files

GDrv.sys Kernel Driver — Ring0 Memory Copy Flaw Abused as a BYOVD Ransomware Primitive

GPCIDrv/GDrv Arbitrary Physical Memory Read/Write — A Signed Driver Turned Kernel Backdoor

GPCIDrv/GDrv Arbitrary I/O Port Access — Kernel Code Execution via a Signed Overclocking Driver

A crafted HTML page exploits a V8 engine flaw for sandboxed code execution across Chrome, Edge, and other Chromium browsers

An out-of-bounds write in the V8 JavaScript engine allows sandboxed code execution from a single malicious web page

Acrobat/Reader Double-Free — Code Execution via a Malicious PDF

V8 Integer Overflow — Heap Corruption via a Crafted Web Page, Affecting Chrome, Edge, and Opera

Apple iOS/macOS/tvOS/watchOS Memory Corruption — Code Execution via a Malicious App or Crafted Content

QNAP File Station XSS — Session Hijacking on Internet-Exposed NAS Appliances

Windows Kernel — Privilege Escalation Zero-Day Chained With Browser Exploits in Targeted Attacks

Flash Player Zero-Day Delivered via Weaponized Excel Documents in a Middle East-Targeted Campaign

Windows Win32k.sys — Kernel Privilege Escalation Exploited in Targeted Attacks Before Patch

Windows Shell — Remote Code Execution via Improper File Path Validation

Cisco IOS/IOS XE/IOS XR — Adjacent-Network RCE via Crafted LLDP Frames

Cisco Catalyst 4500/4500-X — iosd Process Crash via Crafted BFD Offload Packets

Cisco IOS/IOS XE — Memory Exhaustion Reload via Crafted IKEv1 Negotiation Packets

Cisco IOS/IOS XE — DHCP Option 82 Parsing Flaw Causes Unauthenticated Device Reload

Cisco IOS/IOS XE — DHCPv4 Option 82 Restore Function Flaw Enables Remote DoS

Cisco IOS/IOS XE — Third DHCP Option 82 Encapsulation Bug in the March 2018 Bundle

VMware SD-WAN Edge (VeloCloud) — Command Injection in the Local Web Management UI

Cisco IOS/IOS XE/IOS XR — LLDP Format String Flaw Enables Adjacent-Network Code Execution

Windows DirectX Graphics Kernel (DXGKRNL) — Local Privilege Escalation via Kernel Memory Handling

Windows DirectX Graphics Kernel (DXGKRNL) — Second Kernel Privilege Escalation Patched Alongside CVE-2018-8405

Windows ALPC Task Scheduler — Public Zero-Day Disclosed by "SandboxEscaper" Before a Patch Existed

Internet Explorer Scripting Engine — Memory Corruption Remote Code Execution

Cisco ISM-VPN — Crypto Engine Crash via Crafted IPsec Traffic Causes Router Reload

Cisco Smart Install — Unauthenticated Device Reload via Crafted Smart Install Messages

Cisco IOS/IOS XE — Unauthenticated Device Reload via Crafted IKEv1 Packets

ChakraCore Scripting Engine — Type Confusion Remote Code Execution in Microsoft Edge

Microsoft Exchange Server — Server-Side Request Forgery Enabling User Impersonation

Windows Win32k — Kernel Privilege Escalation Exploited as a Zero-Day Before Patch Tuesday

A zero-day used in a targeted spear-phishing campaign against a Russian hospital network, embedded in a malicious Office document

The UNACEV2.dll ACE Extraction Bug — A 19-Year-Old Unpatched Library Behind WinRAR's Worst RCE

"Double Kill" — Windows VBScript Engine Zero-Day Used in Targeted Attacks Before Patch

Windows Win32k — Zero-Day Privilege Escalation Exploited by the FruityArmor APT Group

Microsoft Office — Equation Editor Memory Corruption RCE via Malicious Document, Widely Weaponized in Malspam

The 'Struts Showcase' OGNL injection — namespace handling flaw lets attackers execute code via a crafted URL alone

Microsoft Office — Second Equation Editor Memory Corruption RCE, Companion to CVE-2018-0798

Flash Player Zero-Day — Weaponized by North Korea-Linked APT37 Against South Korean Targets

Cisco ASA — Unauthenticated Directory Traversal via Crafted HTTP URLs Enables DoS and Info Disclosure

A weak encryption scheme protecting DNN's input parameters lets attackers tamper with encrypted values — later required a second fix

The follow-up fix for CVE-2018-15811 — an incomplete first patch left DNN's weak input-parameter encryption exploitable

Internet Explorer Scripting Engine — Zero-Day Discovered by Google TAG, Patched Out-of-Band