Week 43, 2016
24–30 October 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 33%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-8582 A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database in…EPSS 57%
-
Unscored
CVE-2016-8581 A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal s…EPSS 17%
-
Medium 6.6
CVE-2016-8339 A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in …EPSS 15%
-
Unscored
CVE-2016-3473 Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remo…EPSS 14%
-
Unscored
CVE-2016-9018 Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks RealPlayer 18.1.5.…EPSS 8.1%
-
Unscored
CVE-2016-5764 Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Fixed in: Rumba FTP 4.5 (HF 14668).…EPSS 7.8%
-
Unscored
CVE-2016-8283 Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availabili…EPSS 7%
-
Unscored
CVE-2016-8580 PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code ex…EPSS 6.9%
Advisories
- SUSE / openSUSE Security Updates 272 critical
- Debian Security (DSA / DLA) 24
- Ubuntu Security Notices (USN) 6
- CISA ICS & IT advisories 31 critical
- Oracle Linux Security Advisories (ELSA) 1
- ICSA-16-026-02 Rockwell Automation MicroLogix 1100 PLC Overflow Vulnerability 1 CVEs
- SUSE-SU-2016:2652-1 Security update for libxml2 1 CVEs
- SUSE-SU-2016:2650-1 Security update for libxml2 1 CVEs