Week 3, 2017
16–22 January 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.1
CVE-2017-5521 An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They ar…EPSS 89%
-
Unscored
CVE-2016-6896 Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated us…EPSS 38%
-
High 8.8
CVE-2016-5198 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumpt…EPSS 34%
-
Unscored
CVE-2016-2233 Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash)…EPSS 34%
-
Unscored
CVE-2016-6897 Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remo…EPSS 29%
- Medium 5.9 EPSS 24%
-
Unscored
CVE-2016-7982 Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the…EPSS 21%
-
Unscored
CVE-2016-7998 The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a …EPSS 13%
Advisories
- SUSE / openSUSE Security Updates 323 critical
- Debian Security (DSA / DLA) 143 critical
- Oracle Linux Security Advisories (ELSA) 41 critical
- CISA ICS & IT advisories 41 critical
- Ubuntu Security Notices (USN) 2
- ELSA-2017-0180 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 11 CVEs
- DLA-794-1 groovy - security update 1 CVEs
- DSA-3769-1 libphp-swiftmailer - security update 1 CVEs
- DLA-792-1 libphp-swiftmailer - security update 1 CVEs
- SUSE-RU-2017:0174-1 Recommended update for SUSE Manager Client Tools 1 CVEs
- SUSE-RU-2017:0169-1 Recommended update for Salt 1 CVEs
- SUSE-RU-2017:0171-1 Recommended update for salt 1 CVEs
- ICSA-17-017-01 PHOENIX CONTACT mGuard 1 CVEs