Week 14, 2017
3–9 April 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 90%
-
Critical 9.8
CVE-2016-6809 Apache Tika allows Java code execution for serialized objects embedded in MATLAB filesEPSS 8%
-
Critical 9.8
CVE-2017-7575 Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\x00\x00\x00\x05\x01…EPSS 4.1%
-
Critical 10.0
CVE-2017-7574 Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection…EPSS 1.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-1001000 The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not requ…EPSS 85%
-
Unscored
CVE-2017-7581 SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands…EPSS 48%
-
Unscored
CVE-2017-7413 In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Hord…EPSS 39%
-
Unscored
CVE-2017-6019 An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the dev…EPSS 37%
-
High 8.8
CVE-2017-6884 A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic…EPSS 33%
-
Unscored
CVE-2017-0561 A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary code within the context of the Wi-Fi S…EPSS 30%
-
Unscored
CVE-2017-7577 XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request.EPSS 28%
-
Unscored
CVE-2014-1677 Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.EPSS 18%
Advisories
- SUSE / openSUSE Security Updates 18
- Debian Security (DSA / DLA) 101 critical
- Ubuntu Security Notices (USN) 5
- CISA ICS & IT advisories 52 critical
- BSI CERT-Bund (WID) 1
- ICSA-17-094-02B Marel Food Processing Systems (Update B) 3 CVEs
- DLA-888-1 logback - security update 1 CVEs
- ICSA-17-094-03 Rockwell Automation Allen-Bradley Stratix and Allen-Bradley ArmorStratix 1 CVEs