Week 42, 2016
17–23 October 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-2848 ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malform…EPSS 26%
-
Unscored
CVE-2003-0586 Brooky eStore 1.0.1 through 1.0.2b allows remote attackers to obtain sensitive path information via a direct HTTP request to settings.inc.php.EPSS 5.6%
-
Unscored
CVE-2016-7853 Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.…EPSS 4.8%
-
Unscored
CVE-2016-7852 Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.…EPSS 3.8%
-
Unscored
CVE-2016-7854 Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.…EPSS 3.8%
-
Unscored
CVE-2003-0589 admin.php in Digi-ads 1.1 allows remote attackers to bypass authentication via a cookie with the username set to the name of the administrator, which satisfies…EPSS 3.2%
-
Unscored
CVE-2003-0588 admin.php in Digi-news 1.1 allows remote attackers to bypass authentication via a cookie with the username set to the name of the administrator, which satisfie…EPSS 3.2%
- Unscored EPSS 2.9%
Advisories
- Debian Security (DSA / DLA) 19
- SUSE / openSUSE Security Updates 191 critical
- Ubuntu Security Notices (USN) 5
- Oracle Linux Security Advisories (ELSA) 31 critical
- CISA ICS & IT advisories 21 critical
- BSI CERT-Bund (WID) 2
- ICSA-16-014-01 Advantech WebAccess Vulnerabilities 15 CVEs
- ELSA-2016-2079 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 5 CVEs
- SUSE-SU-2016:2555-1 Security update for openssh-openssl1 5 CVEs