Week 10, 2017
6–12 March 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-5638 Apache Struts vulnerable to remote arbitrary command execution due to improper input validationEPSS 100%
-
Critical 10.0
CVE-2017-2788 A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's c…EPSS 7.8%
-
Critical 9.8
CVE-2017-3159 Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serializationEPSS 6.3%
-
Critical 10.0
CVE-2017-2785 An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to th…EPSS 5.2%
-
Critical 9.0
CVE-2017-2787 A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's c…EPSS 4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2017-6334 dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metachara…EPSS 73%
-
Unscored
CVE-2017-6526 An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrativ…EPSS 57%
-
Unscored
CVE-2017-6527 An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacke…EPSS 57%
-
Unscored
CVE-2017-6465 Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to; however, it doe…EPSS 50%
-
Unscored
CVE-2016-6255 Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handle…EPSS 27%
-
Unscored
CVE-2017-6548 Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-A…EPSS 21%
-
Unscored
CVE-2017-6558 iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote attackers …EPSS 15%
-
Unscored
CVE-2017-5178 An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These version…EPSS 14%
Advisories
- SUSE / openSUSE Security Updates 14
- Debian Security (DSA / DLA) 131 critical
- Ubuntu Security Notices (USN) 11
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 21 critical
- Oracle Linux Security Advisories (ELSA) 11 critical
- CERT@VDE 1
- ELSA-2017-0461 Critical: firefox security update (Oracle Linux 7) 9 CVEs
- ICSA-17-066-01 ICSA-17-066-01_Schneider Electric Wonderware Intelligence 1 CVEs
- DLA-846-1 libzip-ruby - security update 1 CVEs