Week 29, 2016
18–24 July 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-3510 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affec…EPSS 91%
-
Unscored
CVE-2016-2775 ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to…EPSS 63%
-
Unscored
CVE-2016-5387 The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in…EPSS 56%
- High 8.1 EPSS 51%
- High 8.1 EPSS 50%
-
Unscored
CVE-2016-4622 WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (me…EPSS 20%
-
Unscored
CVE-2016-3586 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affec…EPSS 20%
-
Unscored
CVE-2016-5743 Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMA…EPSS 10%
Advisories
- Debian Security (DSA / DLA) 14
- SUSE / openSUSE Security Updates 7
- Ubuntu Security Notices (USN) 4
- CISA ICS & IT advisories 21 critical
- Oracle Linux Security Advisories (ELSA) 21 critical
- BSI CERT-Bund (WID) 2
- ELSA-2016-1458 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 8 CVEs
- ICSA-16-292-01 Schneider Electric PowerLogic PM8ECC Hard-coded Password Vulnerability 1 CVEs