Apache Virtual Computing Lab vulnerabilities

3 CVEs affecting Apache Virtual Computing Lab, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-11774, published 2019-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-11773, published 2019-07-29. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime.…
CVE-2018-11774, published 2019-07-29. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection…
CVE-2018-11772, published 2019-07-29. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL…