Week 29, 2017
17–23 July 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-11467 OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injectionEPSS 73%
-
Critical 9.8
CVE-2017-6316 Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBri…EPSS 73%
- Critical 9.8 EPSS 3.7%
- Critical 9.8 EPSS 3%
- Critical 9.8 EPSS 1.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 95%
-
High 8.8
CVE-2017-6736 The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, r…EPSS 70%
-
High 8.8
CVE-2017-6737 A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute cod…EPSS 45%
-
Unscored
CVE-2017-9765 Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to…EPSS 42%
-
Unscored
CVE-2017-11517 Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary code via a…EPSS 29%
-
Unscored
CVE-2017-11403 The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file.EPSS 28%
-
High 8.8
CVE-2017-6742 A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute cod…EPSS 21%
Cisco · IntelliShield · Cisco IOS XE Software · Universal Product
-
Unscored
CVE-2017-8011 EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, …EPSS 14%
Advisories
- SUSE / openSUSE Security Updates 22
- Debian Security (DSA / DLA) 14
- Ubuntu Security Notices (USN) 6
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 21 critical
- CISA ICS & IT advisories 1
- ELSA-2017-1789 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 21 CVEs