Week 6, 2017

6–12 February 2017

New CVEs: 219
Critical: 5
High: 5
Newly exploited: 0
Advisories: 48
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2015-2794 The installation wizard in DotNetNuke (DNN) allows privilege escalation
EPSS 75%
Critical 9.8
CVE-2017-5941 Code Execution through IIFE in node-serialize
EPSS 61%
Critical 9.8
CVE-2017-5954 Code Execution Through IIFE in serialize-to-js
EPSS 4.5%
Critical 9.8
CVE-2016-2403 Symfony Authentication Bypass
EPSS 4.3%
Critical 9.1
CVE-2016-9639 Salt allows deleted minions to read or write to minions with the same id
EPSS 2.7%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories