Week 34, 2017
21–27 August 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-11317 Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attack…EPSS 84%
-
Critical 9.8
CVE-2017-11357 Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbit…EPSS 78%
- Critical 9.8 EPSS 7.5%
- Critical 9.8 EPSS 4.7%
-
Critical 9.8
CVE-2015-5224 The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.EPSS 4.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 88%
-
Unscored
CVE-2015-2857 Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.EPSS 84%
-
Unscored
CVE-2017-9506 The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers t…EPSS 76%
-
Unscored
CVE-2017-12786 Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch device…EPSS 25%
-
Unscored
CVE-2017-12787 A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch dev…EPSS 25%
-
Unscored
CVE-2014-7859 Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build…EPSS 21%
-
Unscored
CVE-2017-12785 The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is prone to a buffer ov…EPSS 16%
-
Unscored
CVE-2017-12965 Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.EPSS 16%
Advisories
- SUSE / openSUSE Security Updates 162 critical
- Debian Security (DSA / DLA) 151 critical
- Ubuntu Security Notices (USN) 6
- CISA ICS & IT advisories 52 critical
- BSI CERT-Bund (WID) 4
- Oracle Linux Security Advisories (ELSA) 3
- DSA-3952-1 libxml2 - security update 7 CVEs
- ICSA-17-236-01 ICSA-17-236-01_Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 3 CVEs
- ICSA-17-234-04 General Motors and Shanghai OnStar (SOS) iOS Client 3 CVEs
- SUSE-SU-2017:2250-1 Security update for mercurial 2 CVEs
- SUSE-SU-2017:2251-1 Security update for mercurial 2 CVEs