Week 28, 2017
10–16 July 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 99%
- Critical 9.8 EPSS 3.9%
- Critical 9.8 EPSS 3.6%
- Critical 9.8 EPSS 2.8%
- Critical 10.0 EPSS 2.7%
- Critical 10.0 EPSS 2.3%
- Critical 9.9 EPSS 2.3%
- Critical 9.1 EPSS 2.1%
-
Critical 9.8
CVE-2017-10601 Junos OS: Insufficient authentication for user login when a specific system configuration error occurs.EPSS 1.8%
- Critical 9.8 EPSS 1.7%
- Critical 9.8 EPSS 1.6%
- Critical 9.6 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-1000028 Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploit…EPSS 99%
-
High 7.8
CVE-2017-8570 Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vul…EPSS 90%
Microsoft · Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016.
-
Unscored
CVE-2017-8601 Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the cu…EPSS 67%
Microsoft · Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016
-
Unscored
CVE-2017-11165 dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile…EPSS 64%
-
Unscored
CVE-2017-7529 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of pote…EPSS 63%
-
Unscored
CVE-2017-8618 Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 16…EPSS 58%
Microsoft · Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016
-
Unscored
CVE-2017-9788 In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset bef…EPSS 57%
-
Unscored
CVE-2017-8594 Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the cu…EPSS 50%
Microsoft · Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2
Advisories
- SUSE / openSUSE Security Updates 18
- Debian Security (DSA / DLA) 13
- CISA ICS & IT advisories 71 critical
- Ubuntu Security Notices (USN) 4
- BSI CERT-Bund (WID) 3
- ICSA-17-194-01 Siemens SiPass integrated 4 CVEs