Week 16, 2016
18–24 April 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-2004 HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to la…EPSS 94%
-
Unscored
CVE-2016-1593 Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to uploa…EPSS 64%
-
Unscored
CVE-2016-0638 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to aff…EPSS 63%
-
Unscored
CVE-2016-2390 The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with…EPSS 26%
-
Unscored
CVE-2016-2006 HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN…EPSS 20%
-
Unscored
CVE-2016-2005 HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN…EPSS 20%
-
Unscored
CVE-2016-2007 HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN…EPSS 20%
-
Unscored
CVE-2016-2008 HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors.EPSS 10%
Advisories
- SUSE / openSUSE Security Updates 6
- Ubuntu Security Notices (USN) 5
- Debian Security (DSA / DLA) 4
- BSI CERT-Bund (WID) 2
- Oracle Linux Security Advisories (ELSA) 22 critical
- ELSA-2016-0650 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 6 CVEs
- ELSA-2016-0676 Critical: java-1.7.0-openjdk security update (Oracle Linux 7) 5 CVEs