Week 48, 2015
23–29 November 2015
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 92%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-7808 The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute …EPSS 81%
- High 7.5 EPSS 23%
-
Unscored
CVE-2015-7981 The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sens…EPSS 6.4%
-
Unscored
CVE-2015-8320 Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking a…EPSS 4.4%
-
Unscored
CVE-2015-5256 Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which al…EPSS 4.2%
-
Unscored
CVE-2015-6857 Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12.02, and 12.50 allows remote attackers to execute arbitrary cod…EPSS 3.8%
-
Unscored
CVE-2015-7287 CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, which allows remot…EPSS 3.2%
- Medium EPSS 3.2%
Advisories
- Oracle Linux Security Advisories (ELSA) 34
- Debian Security (DSA / DLA) 16
- SUSE / openSUSE Security Updates 121 critical
- CISA ICS & IT advisories 52 critical
- Ubuntu Security Notices (USN) 4
- Siemens ProductCERT 11 critical
- SUSE-SU-2015:2108-1 Security update for the Linux Kernel 8 CVEs
- ICSA-15-057-01 Network Vision IntraVue Code Injection Vulnerability 1 CVEs
- SSA-763427 SSA-763427: Authentication Bypass Vulnerability in SIMATIC CP and TIM Devices 1 CVEs
- ICSA-15-335-03 Siemens SIMATIC Communication Processor Vulnerability (Update C) 1 CVEs