Week 18, 2017
1–7 May 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-7921 An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build…EPSS 100%
-
Critical 9.8
CVE-2017-5689 An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Stand…EPSS 92%
Intel · Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability
-
Critical 9.1
CVE-2017-6519 avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote att…EPSS 3.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-8779 rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory …EPSS 81%
- Unscored EPSS 57%
- Unscored EPSS 55%
-
Unscored
CVE-2017-7925 A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-…EPSS 51%
-
Unscored
CVE-2017-7927 A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW…EPSS 37%
- Unscored EPSS 32%
-
Unscored
CVE-2017-8295 WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passw…EPSS 27%
-
Unscored
CVE-2017-8303 An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method p…EPSS 24%
Advisories
- SUSE / openSUSE Security Updates 17
- Debian Security (DSA / DLA) 93 critical
- CISA ICS & IT advisories 63 critical
- Ubuntu Security Notices (USN) 3
- BSI CERT-Bund (WID) 1
- DSA-3844-1 tiff - security update 18 CVEs
- ICSA-17-124-02 Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras 2 CVEs
- ICSA-17-124-01 Hikvision Cameras 2 CVEs
- DSA-3842-1 tomcat7 - security update 2 CVEs
- DSA-3843-1 tomcat8 - security update 2 CVEs
- ICSA-17-122-03 Advantech B+B SmartWorx MESR901 1 CVEs