Week 32, 2017
7–13 August 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 20%
- Critical 9.1 EPSS 10%
- Critical 9.8 EPSS 4.3%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 2.9%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2017-12637 Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers t…EPSS 95%
-
Unscored
CVE-2015-7871 Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.EPSS 82%
-
Unscored
CVE-2017-12478 It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated…EPSS 78%
-
Unscored
CVE-2017-8636 Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1…EPSS 72%
-
Unscored
CVE-2017-8641 Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1…EPSS 72%
-
Unscored
CVE-2017-8634 Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft brows…EPSS 70%
-
Unscored
CVE-2017-8646 Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to t…EPSS 69%
-
Unscored
CVE-2017-8671 Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current use…EPSS 69%
Advisories
- SUSE / openSUSE Security Updates 444 critical
- Oracle Linux Security Advisories (ELSA) 352 critical
- Debian Security (DSA / DLA) 241 critical
- Ubuntu Security Notices (USN) 111 critical
- CISA ICS & IT advisories 72 critical
- BSI CERT-Bund (WID) 4
- ELSA-2017-2424 Critical: java-1.7.0-openjdk security update (Oracle Linux 7) 18 CVEs
- ELSA-2017-2456 Critical: firefox security update (Oracle Linux 7) 15 CVEs
- ICSA-17-220-01 OSIsoft PI Integrator 2 CVEs
- SUSE-SU-2017:2141-1 Security update for libxml2 1 CVEs
- USN-3383-1 libsoup2.4 vulnerability 1 CVEs
- SUSE-SU-2017:2129-1 Security update for libsoup 1 CVEs
- SUSE-SU-2017:2130-1 Security update for libsoup 1 CVEs
- DSA-3929-1 libsoup2.4 - security update 1 CVEs
- ICSA-17-222-05 ABB SREA-01 and SREA-50 1 CVEs
- SUSE-SU-2017:2115-1 Security update for libxml2 1 CVEs