Week 21, 2017
22–28 May 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 49%
-
Critical 9.8
CVE-2017-6862 NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code…EPSS 46%
- Critical 9.8 EPSS 1.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-10073 The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potential…EPSS 84%
-
High 8.8
CVE-2016-4977 Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel viewsEPSS 80%
-
Unscored
CVE-2017-1092 IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID…EPSS 76%
-
High 7.8
CVE-2017-8540 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…EPSS 72%
-
Unscored
CVE-2017-8538 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…EPSS 50%
-
Unscored
CVE-2017-8541 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…EPSS 48%
-
Unscored
CVE-2015-4455 Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote a…EPSS 41%
-
Unscored
CVE-2015-5468 Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (d…EPSS 38%
Advisories
- SUSE / openSUSE Security Updates 195 critical
- Debian Security (DSA / DLA) 172 critical
- Oracle Linux Security Advisories (ELSA) 8
- Ubuntu Security Notices (USN) 52 critical
- CISA ICS & IT advisories 11 critical
- SUSE-SU-2017:1382-1 Security update for tomcat 3 CVEs
- ICSA-17-143-01 Moxa OnCell 3 CVEs
- USN-3300-1 juju-core vulnerability 1 CVEs
- USN-3296-1 samba vulnerability 1 CVEs
- SUSE-SU-2017:1391-1 Security update for samba 1 CVEs
- SUSE-SU-2017:1392-1 Security update for samba 1 CVEs
- SUSE-SU-2017:1393-1 Security update for samba 1 CVEs
- SUSE-SU-2017:1396-1 Security update for samba 1 CVEs
- DSA-3860-1 samba - security update 1 CVEs
- DLA-951-1 samba - security update 1 CVEs