Week 44, 2016
31 October – 6 November 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 4.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-8869 The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain …EPSS 97%
-
Unscored
CVE-2016-8870 The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disa…EPSS 81%
-
Unscored
CVE-2016-8864 named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion fai…EPSS 39%
-
High 8.8
CVE-2016-7855 Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute ar…EPSS 25%
-
Unscored
CVE-2016-9086 GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a u…EPSS 5.4%
- High 8.8 EPSS 5.2%
- High 7.5 EPSS 5.1%
-
Unscored
CVE-2016-6441 A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, …EPSS 4.9%
Advisories
- SUSE / openSUSE Security Updates 201 critical
- Debian Security (DSA / DLA) 183 critical
- Ubuntu Security Notices (USN) 102 critical
- BSI CERT-Bund (WID) 5
- CISA ICS & IT advisories 32 critical
- Oracle Linux Security Advisories (ELSA) 2
- DLA-701-1 memcached - security update 4 CVEs
- ICSA-16-033-01 Sauter moduWeb Vision Vulnerabilities 3 CVEs
- DSA-3704-1 memcached - security update 3 CVEs
- USN-3120-1 memcached vulnerabilities 3 CVEs
- USN-3115-1 python-django vulnerabilities 2 CVEs
- DLA-691-1 libxml2 - security update 2 CVEs
- SUSE-OU-2016:2857-1 Add headmore to SUSE PackageHub 1 CVEs
- ICSA-16-028-01A Westermo Industrial Switch Hard-coded Certificate Vulnerability (Update A) 1 CVEs