Week 20, 2017
15–21 May 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 15%
- Critical 9.8 EPSS 13%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-8917 SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.EPSS 100%
-
Unscored
CVE-2017-9100 login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password …EPSS 85%
-
Unscored
CVE-2016-10372 The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstra…EPSS 82%
-
Unscored
CVE-2017-9101 import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the …EPSS 77%
-
Unscored
CVE-2017-9080 PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted …EPSS 62%
-
Unscored
CVE-2017-6622 A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and pe…EPSS 62%
-
Unscored
CVE-2017-5174 An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identif…EPSS 52%
-
Unscored
CVE-2017-6079 The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables…EPSS 47%
Advisories
- SUSE / openSUSE Security Updates 47
- Ubuntu Security Notices (USN) 16
- Debian Security (DSA / DLA) 14
- CISA ICS & IT advisories 72 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 2
- ICSA-17-136-01 Detcon SiteWatch Gateway 2 CVEs
- ICSA-17-136-03 Hanwha Techwin SRN-4000 1 CVEs