Week 33, 2016
15–21 August 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2016-6366 Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 93…EPSS 88%
-
High 7.8
CVE-2016-6367 Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid…EPSS 23%
-
Unscored
CVE-2014-9906 Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via ve…EPSS 6.1%
-
Unscored
CVE-2016-6254 Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of…EPSS 5.7%
- Medium 6.1 EPSS 4.9%
-
Unscored
CVE-2015-8949 Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_e…EPSS 4.5%
-
Unscored
CVE-2016-1457 The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software…EPSS 3.7%
-
Unscored
CVE-2016-0760 Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2)…EPSS 3.3%
Advisories
- SUSE / openSUSE Security Updates 151 critical
- Debian Security (DSA / DLA) 7
- Ubuntu Security Notices (USN) 6
- Oracle Linux Security Advisories (ELSA) 4
- CISA ICS & IT advisories 33 critical
- SUSE-SU-2016:2074-1 Security update for the Linux Kernel 48 CVEs
- ICSA-16-320-01 Lynxspring JENEsys BAS Bridge Vulnerabilities 4 CVEs
- ICSA-16-322-02 Moxa SoftCMS Vulnerabilities 3 CVEs
- ICSA-16-322-01 Vanderbilt Industries Siemens IP CCTV Cameras Vulnerability 1 CVEs