Week 8, 2016

22–28 February 2016

New CVEs: 65
Critical: 0
High: 7
Newly exploited: 0
Advisories: 65
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Unscored
CVE-2016-2569 Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (asserti…
EPSS 31%
Unscored
CVE-2015-8277 Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute …
EPSS 29%
Medium 5.3
CVE-2015-5345 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
EPSS 18%
High 8.8
CVE-2016-0714 Improper Access Control in Apache Tomcat
EPSS 13%
Medium 4.3
CVE-2015-5174 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
EPSS 13%
Medium 6.3
CVE-2016-0763 Improper Verification of Source of a Communication Channel in Apache Tomcat
EPSS 11%
High 8.1
CVE-2015-5346 Improper Neutralization of Input During Web Page Generation in Apache Tomcat
EPSS 11%
Unscored
CVE-2016-2572 http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of servic…
EPSS 10%

Advisories

ICSA-16-145-01A Moxa MiiNePort Vulnerabilities 3 CVEs
ICSA-16-147-01B Environmental Systems Corporation Data Controllers Vulnerabilities 2 CVEs
ICSA-16-147-02 Sixnet BT Series Hard-coded Credentials Vulnerability 1 CVEs