Week 19, 2016
9–15 May 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2016-4117 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.EPSS 94%
-
High 7.5
CVE-2016-0189 The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to exe…EPSS 94%
-
Unscored
CVE-2016-4553 client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attacke…EPSS 80%
-
Unscored
CVE-2016-4350 Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) be…EPSS 70%
-
High 7.8
CVE-2016-0185 Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (…EPSS 70%
-
Unscored
CVE-2016-2296 Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to ob…EPSS 64%
-
Unscored
CVE-2016-1209 The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST re…EPSS 62%
-
Unscored
CVE-2016-0170 GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Window…EPSS 49%
Advisories
- Debian Security (DSA / DLA) 21
- SUSE / openSUSE Security Updates 123 critical
- Oracle Linux Security Advisories (ELSA) 71 critical
- Ubuntu Security Notices (USN) 61 critical
- CISA ICS & IT advisories 2
- BSI CERT-Bund (WID) 2
- SUSE-SU-2016:1303-1 Security update for java-1_6_0-ibm 10 CVEs
- SUSE-SU-2016:1300-1 Security update for java-1_7_1-ibm 10 CVEs
- SUSE-SU-2016:1299-1 Security update for java-1_7_1-ibm 10 CVEs
- ELSA-2016-0723 Critical: java-1.6.0-openjdk security update (Oracle Linux 7) 5 CVEs
- USN-2966-1 openssh vulnerabilities 4 CVEs