Week 14, 2016
4–10 April 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 12%
- Critical 9.8 EPSS 2.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 83%
-
High 7.3
CVE-2016-2098 actionpack allows remote code execution via application's unrestricted use of render methodEPSS 81%
- High 8.1 EPSS 70%
-
High 7.5
CVE-2016-3976 Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the…EPSS 47%
-
Unscored
CVE-2016-3948 Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP …EPSS 35%
-
Unscored
CVE-2016-2563 Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of serv…EPSS 33%
-
Unscored
CVE-2016-1011 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Lin…EPSS 25%
-
Unscored
CVE-2016-2851 Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application …EPSS 24%