Week 6, 2016

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2016-1524 Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java cod…
  EPSS 94%
• Unscored
  CVE-2016-0041 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold a…
  EPSS 83%
• Unscored
  CVE-2016-1525 Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read ar…
  EPSS 75%
• Unscored
  CVE-2016-1287 Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9…
  EPSS 74%
• High 8.8
  CVE-2016-0984 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, …
  EPSS 55%
• High 7.5
  CVE-2016-0956 Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post
  EPSS 51%
• Unscored
  CVE-2016-0957 Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass d…
  EPSS 51%
• Unscored
  CVE-2016-0063 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web s…
  EPSS 39%