Week 16, 2017
17–23 April 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2016-1555 (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP2…EPSS 98%
- Critical 9.8 EPSS 89%
- Critical 9.8 EPSS 28%
- Critical 9.1 EPSS 13%
- Critical 9.8 EPSS 7.8%
- Critical 9.8 EPSS 6.3%
-
Critical 9.1
CVE-2016-8721 An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware …EPSS 3.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-1561 ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH…EPSS 74%
-
Unscored
CVE-2016-1560 ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in…EPSS 72%
- Unscored EPSS 51%
-
Unscored
CVE-2017-7692 SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in…EPSS 32%
- High 7.5 EPSS 17%
-
Unscored
CVE-2017-8051 Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_ap…EPSS 16%
- Medium 5.3 EPSS 11%
-
Unscored
CVE-2016-5399 The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-…EPSS 9.8%
Advisories
- SUSE / openSUSE Security Updates 23
- Debian Security (DSA / DLA) 15
- Oracle Linux Security Advisories (ELSA) 52 critical
- Ubuntu Security Notices (USN) 4
- BSI CERT-Bund (WID) 31 critical
- WID-SEC-2024-1277 Oracle Fusion Middleware: Mehrere Schwachstellen 50 CVEs
- ELSA-2017-1106 Critical: firefox security update (Oracle Linux 7) 31 CVEs
- ELSA-2017-1100 Critical: nss and nss-util security update (Oracle Linux 7) 1 CVEs