Week 11, 2016

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2016-2345 Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code…
  EPSS 51%
• Unscored
  CVE-2016-2342 The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, …
  EPSS 13%
• Unscored
  CVE-2016-1988 HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unsp…
  EPSS 11%
• Unscored
  CVE-2016-1989 HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unsp…
  EPSS 11%
• Unscored
  CVE-2016-1995 HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.
  EPSS 10%
• Unscored
  CVE-2016-3191 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) sub…
  EPSS 8.4%
• Unscored
  CVE-2016-2245 HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors.
  EPSS 5.9%
• Unscored
  CVE-2015-8154 The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows re…
  EPSS 5%