{"history":[{"alert":0,"cve":"CVE-2018-8298","id":21816,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.74694, \"percentile\": 0.99509}"},{"alert":0,"cve":"CVE-2018-8298","id":19433,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.74694, \"percentile\": 0.99506}"},{"alert":0,"cve":"CVE-2018-8298","id":17399,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.74694, \"percentile\": 0.99505}"},{"alert":0,"cve":"CVE-2018-8298","id":15462,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.74694, \"percentile\": 0.99505}"},{"alert":0,"cve":"CVE-2018-8298","id":13440,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.74694, \"percentile\": 0.99505}"},{"alert":0,"cve":"CVE-2018-8298","id":11222,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.74694, \"percentile\": 0.99504}"},{"alert":1,"cve":"CVE-2018-8298","id":10753,"kind":"cna","observed_at":1793960400,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-05T06:54:36.357Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298\"}, {\"name\": \"104639\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/bid/104639\"}, {\"name\": \"45217\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/45217/\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2018-8298\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-02-07T16:26:02.663829Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2022-03-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-843\", \"description\": \"CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:45:49.700Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-03-03T00:00:00.000Z\", \"value\": \"CVE-2018-8298 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"ChakraCore\", \"vendor\": \"Microsoft\", \"versions\": [{\"status\": \"affected\", \"version\": \"ChakraCore\"}]}], \"datePublic\": \"2018-07-10T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka \\\"Scripting Engine Memory Corruption Vulnerability.\\\" This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Remote Code Execution\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2018-08-19T09:57:02.000Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298\"}, {\"name\": \"104639\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"], \"url\": \"http://www.securityfocus.com/bid/104639\"}, {\"name\": \"45217\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/45217/\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"secure@microsoft.com\", \"ID\": \"CVE-2018-8298\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"ChakraCore\", \"version\": {\"version_data\": [{\"version_value\": \"ChakraCore\"}]}}]}, \"vendor_name\": \"Microsoft\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka \\\"Scripting Engine Memory Corruption Vulnerability.\\\" This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Remote Code Execution\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298\", \"refsource\": \"CONFIRM\", \"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298\"}, {\"name\": \"104639\", \"refsource\": \"BID\", \"url\": \"http://www.securityfocus.com/bid/104639\"}, {\"name\": \"45217\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/45217/\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2018-8298\", \"datePublished\": \"2018-07-11T00:00:00.000Z\", \"dateReserved\": \"2018-03-14T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:45:49.700Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2018-8298","id":8968,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.74694, \"percentile\": 0.99504}"},{"alert":0,"cve":"CVE-2018-8298","id":6756,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.74694, \"percentile\": 0.99503}"},{"alert":0,"cve":"CVE-2018-8298","id":4533,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.74694, \"percentile\": 0.99503}"},{"alert":0,"cve":"CVE-2018-8298","id":2315,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.74694, \"percentile\": 0.99503}"},{"alert":1,"cve":"CVE-2018-8298","id":1301,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2018-8298\", \"cwes\": [\"CWE-843\"], \"dateAdded\": \"2022-03-03\", \"dueDate\": \"2022-03-17\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2018-8298\", \"product\": \"ChakraCore scripting engine\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.\", \"vendorProject\": \"ChakraCore\", \"vulnerabilityName\": \"ChakraCore Scripting Engine Type Confusion Vulnerability\"}"}],"record":{"affected":[{"product":"ChakraCore","vendor":"Microsoft","versions":[{"status":"affected","version":"ChakraCore"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T06:54:36.357Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298"},{"name":"104639","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/104639"},{"name":"45217","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/45217/"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2018-8298","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-07T16:26:02.663829Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-03-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-843","description":"CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:45:49.700Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298"}],"timeline":[{"lang":"en","time":"2022-03-03T00:00:00.000Z","value":"CVE-2018-8298 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"ChakraCore","vendor":"Microsoft","versions":[{"status":"affected","version":"ChakraCore"}]}],"datePublic":"2018-07-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296."}],"problemTypes":[{"descriptions":[{"description":"Remote Code Execution","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-08-19T09:57:02.000Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298"},{"name":"104639","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/104639"},{"name":"45217","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/45217/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2018-8298","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"ChakraCore","version":{"version_data":[{"version_value":"ChakraCore"}]}}]},"vendor_name":"Microsoft"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Remote Code Execution"}]}]},"references":{"reference_data":[{"name":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298","refsource":"CONFIRM","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298"},{"name":"104639","refsource":"BID","url":"http://www.securityfocus.com/bid/104639"},{"name":"45217","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/45217/"}]}}}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2018-8298","datePublished":"2018-07-11T00:00:00.000Z","dateReserved":"2018-03-14T00:00:00.000Z","dateUpdated":"2025-10-21T23:45:49.700Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1793960400,"cve":"CVE-2018-8298","description":"A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.","epss":{"date":"2026-11-12","epss":0.74694,"percentile":0.99509},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2018-8298","cwes":["CWE-843"],"dateAdded":"2022-03-03","dueDate":"2022-03-17","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8298","product":"ChakraCore scripting engine","requiredAction":"Apply updates per vendor instructions.","shortDescription":"The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.","vendorProject":"ChakraCore","vulnerabilityName":"ChakraCore Scripting Engine Type Confusion Vulnerability"},"kev_checked":1794522003,"products":"Microsoft ChakraCore","references":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298","http://www.securityfocus.com/bid/104639","https://www.exploit-db.com/exploits/45217/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298"],"score":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"ChakraCore Scripting Engine Type Confusion Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}