Week 52, 2016
26 December 2016 – 1 January 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 100%
- Critical 9.8 EPSS 98%
- Critical 9.8 EPSS 44%
- Critical 9.8 EPSS 38%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-7456 VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to ob…EPSS 33%
-
Unscored
CVE-2016-10081 /usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled duri…EPSS 6.7%
-
High 7.5
CVE-2016-9878 Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitizedEPSS 4.9%
-
Unscored
CVE-2016-7087 Directory traversal vulnerability in the Connection Server in VMware Horizon View 5.x before 5.3.7, 6.x before 6.2.3, and 7.x before 7.0.1 allows remote attack…EPSS 4.4%
-
Unscored
CVE-2016-9942 Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or p…EPSS 3.8%
-
Unscored
CVE-2016-9941 Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) o…EPSS 3.7%
-
Unscored
CVE-2016-7457 VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecif…EPSS 3.2%
-
Unscored
CVE-2016-9223 A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to i…EPSS 2.9%
Advisories
- SUSE / openSUSE Security Updates 17
- Debian Security (DSA / DLA) 153 critical
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 1
- DLA-773-1 python-crypto - security update 1 CVEs
- DLA-770-1 libphp-phpmailer - security update 1 CVEs
- DSA-3750-1 libphp-phpmailer - security update 1 CVEs