Week 40, 2016

3–9 October 2016

New CVEs: 153
Critical: 6
High: 4
Newly exploited: 0
Advisories: 45
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2015-1832 Improper Restriction of XML External Entity Reference in Apace Derby
EPSS 12%
Critical 9.8
CVE-2016-5019 Apache MyFaces Trinidad Deserialization Vulnerability
EPSS 8%
Critical 9.8
CVE-2016-4436 Apache Struts improper action name cleanup
EPSS 6.6%
Critical 9.1
CVE-2014-5414 Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts
Beckhoff · TwinCAT Components featuring Automation Device Specification (ADS) communication · Embedded PC Images

EPSS 4.8%
Critical 9.1
CVE-2014-5415 Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function
Beckhoff · Embedded PC Images · TwinCAT Components featuring Automation Device Specification (ADS) communication

EPSS 4.3%
Critical 9.8
CVE-2016-7405 ADOdb Library SQL Injection
EPSS 3%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

DLA-646-1 zendframework - security update 1 CVEs