Week 15, 2016
11–17 April 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 7.9%
-
Critical 9.8
CVE-2016-0733 The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a passwordEPSS 3.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.2 EPSS 77%
-
Unscored
CVE-2016-0161 Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a d…EPSS 68%
-
High 7.8
CVE-2016-0151 The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages…EPSS 63%
-
Unscored
CVE-2015-8399 Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecor…EPSS 60%
- Medium 6.5 EPSS 55%
-
Unscored
CVE-2016-2056 xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_na…EPSS 55%
- High 8.8 EPSS 52%
-
Unscored
CVE-2016-2171 The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (…EPSS 43%
Advisories
- SUSE / openSUSE Security Updates 21
- Debian Security (DSA / DLA) 8
- CISA ICS & IT advisories 41 critical
- BSI CERT-Bund (WID) 2
- Ubuntu Security Notices (USN) 1
- Oracle Linux Security Advisories (ELSA) 11 critical
- ELSA-2016-0612 Critical: samba and samba4 security, bug fix, and enhancement update (Oracle Linux 7) 8 CVEs
- ICSA-16-196-02 Moxa MGate Authentication Bypass Vulnerability 1 CVEs