Week 39, 2017
25 September – 1 October 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-12240 The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker…EPSS 14%
- Critical 9.8 EPSS 8.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-8249 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the Connecti…EPSS 74%
-
Unscored
CVE-2017-14942 Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/Downl…EPSS 61%
-
Unscored
CVE-2017-14849 Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation …EPSS 54%
-
Unscored
CVE-2017-14867 Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands s…EPSS 36%
-
Unscored
CVE-2017-14955 Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain se…EPSS 12%
- Unscored EPSS 11%
-
Unscored
CVE-2017-11120 On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer …EPSS 9.1%
-
Unscored
CVE-2017-14704 Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authen…EPSS 8.5%
Advisories
- Debian Security (DSA / DLA) 151 critical
- SUSE / openSUSE Security Updates 10
- Oracle Linux Security Advisories (ELSA) 41 critical
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 1
- Siemens ProductCERT 1
- Ubuntu Security Notices (USN) 1
- ELSA-2017-2831 Critical: firefox security update (Oracle Linux 7) 7 CVEs
- DLA-1114-1 ruby1.9.1 - security update 7 CVEs