Week 36, 2017
4–10 September 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-14147 An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory se…EPSS 66%
-
Unscored
CVE-2017-1000083 backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt fi…EPSS 51%
-
Unscored
CVE-2017-1129 IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and ha…EPSS 30%
IBM · Notes · Lotus Expeditor
-
Unscored
CVE-2017-1130 IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes…EPSS 29%
- Medium 6.1 EPSS 24%
-
Unscored
CVE-2017-14135 enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS comm…EPSS 22%
- Unscored EPSS 13%
-
Unscored
CVE-2017-13713 T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg.EPSS 9.1%
Advisories
- SUSE / openSUSE Security Updates 141 critical
- Debian Security (DSA / DLA) 132 critical
- BSI CERT-Bund (WID) 5
- CISA ICS & IT advisories 4
- Ubuntu Security Notices (USN) 4
- CERT@VDE 11 critical
- Oracle Linux Security Advisories (ELSA) 1
- VDE-2017-002 PHOENIX CONTACT: mGuard device manager (mdm) multiple vulnerabilities in Java SE 10 CVEs
- DSA-3966-1 ruby2.3 - security update 7 CVEs
- DSA-3963-1 mercurial - security update 2 CVEs
- SUSE-SU-2017:2350-1 Security update for python-pycrypto 1 CVEs