Week 4, 2016
25–31 January 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-8770 Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows re…EPSS 22%
-
Unscored
CVE-2016-1879 The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, when the kernel is configured for IPv6, …EPSS 13%
-
Unscored
CVE-2016-0755 The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote att…EPSS 9.1%
-
Unscored
CVE-2016-0868 Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execut…EPSS 8.7%
-
Unscored
CVE-2016-1985 HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache…EPSS 6.6%
-
High 8.3
CVE-2015-7521 High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-serviceEPSS 6.1%
-
Unscored
CVE-2016-1930 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a de…EPSS 6%
-
Unscored
CVE-2016-1931 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruptio…EPSS 5.7%
Advisories
- Debian Security (DSA / DLA) 203 critical
- SUSE / openSUSE Security Updates 15
- Oracle Linux Security Advisories (ELSA) 61 critical
- Ubuntu Security Notices (USN) 4
- BSI CERT-Bund (WID) 2
- DSA-3454-1 virtualbox - security update 4 CVEs
- DSA-3462-1 radicale - security update 2 CVEs
- ELSA-2016-0071 Critical: firefox security update (Oracle Linux 7) 2 CVEs
- DLA-403-1 radicale - security update 2 CVEs