Week 38, 2017
18–24 September 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-12611 Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literalEPSS 87%
-
Critical 9.8
CVE-2015-1187 The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.EPSS 83%
- Critical 9.8 EPSS 72%
- Critical 9.8 EPSS 8.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.1
CVE-2017-12615 When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the serverEPSS 100%
-
Unscored
CVE-2017-9798 Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has…EPSS 95%
-
Unscored
CVE-2017-14143 The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass a…EPSS 77%
-
Unscored
CVE-2014-9618 The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and sub…EPSS 73%
- High 7.5 EPSS 70%
-
Unscored
CVE-2015-4074 Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the…EPSS 57%
-
Unscored
CVE-2017-14078 SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulne…EPSS 50%
-
Unscored
CVE-2014-8686 CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt…EPSS 37%
Advisories
- SUSE / openSUSE Security Updates 21
- Debian Security (DSA / DLA) 18
- Ubuntu Security Notices (USN) 111 critical
- CISA ICS & IT advisories 63 critical
- Oracle Linux Security Advisories (ELSA) 3
- BSI CERT-Bund (WID) 1
- USN-3424-1 libxml2 vulnerabilities 7 CVEs
- ICSA-17-264-04 iniNet Solutions GmbH SCADA Webserver 1 CVEs
- ICSA-17-264-01 Schneider Electric InduSoft Web Studio, InTouch Machine Edition 1 CVEs
- ICSA-17-262-01 PHOENIX CONTACT mGuard Device Manager 1 CVEs