Week 4, 2017
23–29 January 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2016-9054 An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet…EPSS 7.7%
-
Critical 9.8
CVE-2016-9052 An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet…EPSS 7.7%
- Critical 9.1 EPSS 4.8%
- Critical 9.8 EPSS 3.6%
- Critical 9.8 EPSS 2.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-6601 Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files v…EPSS 98%
-
Unscored
CVE-2017-3248 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.…EPSS 97%
-
Unscored
CVE-2016-4010 Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shoppin…EPSS 93%
-
Unscored
CVE-2016-6600 Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbit…EPSS 91%
-
Unscored
CVE-2016-6603 ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.EPSS 87%
-
Unscored
CVE-2016-6602 ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwor…EPSS 56%
-
Unscored
CVE-2017-3241 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u13…EPSS 33%
Oracle · Java SE · Java SE Embedded · JRockit
-
Unscored
CVE-2016-4338 The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, whe…EPSS 25%
Advisories
- Debian Security (DSA / DLA) 181 critical
- SUSE / openSUSE Security Updates 18
- Ubuntu Security Notices (USN) 51 critical
- CISA ICS & IT advisories 3
- BSI CERT-Bund (WID) 2
- Oracle Linux Security Advisories (ELSA) 21 critical
- DLA-795-1 tiff - security update 17 CVEs
- USN-3177-1 tomcat6, tomcat7, tomcat8 vulnerabilities 11 CVEs
- ELSA-2017-0190 Critical: firefox security update (Oracle Linux 7) 9 CVEs