Week 35, 2017
28 August – 3 September 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 11%
-
Critical 9.8
CVE-2017-12868 SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt moduleEPSS 2.1%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2014-5301 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.EPSS 78%
-
Unscored
CVE-2017-14098 In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header co…EPSS 50%
- Unscored EPSS 45%
-
Unscored
CVE-2014-8676 Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitr…EPSS 40%
-
Unscored
CVE-2017-14103 The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, w…EPSS 30%
- High 7.5 EPSS 29%
-
Unscored
CVE-2015-5958 phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.EPSS 27%
-
Unscored
CVE-2017-3735 While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of…EPSS 21%
Advisories
- Debian Security (DSA / DLA) 241 critical
- SUSE / openSUSE Security Updates 17
- CISA ICS & IT advisories 82 critical
- Ubuntu Security Notices (USN) 6
- BSI CERT-Bund (WID) 6
- Siemens ProductCERT 1
- Oracle Linux Security Advisories (ELSA) 1
- ICSA-17-243-04 OPW Fuel Management Systems SiteSentinel Integra and SiteSentinel iSite 2 CVEs
- DLA-1072-1 mercurial - security update 2 CVEs
- ICSA-17-243-05 Moxa SoftCMS Live Viewer 1 CVEs