Week 41, 2017
9–15 October 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 92%
- Critical 9.8 EPSS 16%
- Critical 9.8 EPSS 5.4%
- Critical 9.8 EPSS 4.8%
- Critical 9.8 EPSS 2.5%
- Critical 9.8 EPSS 2.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2017-11826 Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 200…EPSS 82%
- High 7.5 EPSS 73%
-
Unscored
CVE-2017-11802 ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte…EPSS 69%
-
Unscored
CVE-2017-5791 The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified …EPSS 69%
-
Unscored
CVE-2017-11809 ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte…EPSS 68%
-
Unscored
CVE-2017-11811 ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte…EPSS 65%
-
Unscored
CVE-2017-11799 ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte…EPSS 64%
-
High 7.8
CVE-2017-11774 Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles …EPSS 60%
Advisories
- SUSE / openSUSE Security Updates 233 critical
- Ubuntu Security Notices (USN) 17
- Debian Security (DSA / DLA) 8
- CISA ICS & IT advisories 71 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 3
- Siemens ProductCERT 1
- ICSA-17-283-02 JanTek JTC-200 2 CVEs
- SUSE-SU-2017:2676-1 Security update for Salt 1 CVEs
- SUSE-SU-2017:2674-1 Security update for Salt 1 CVEs
- SUSE-SU-2017:2666-1 Security update for salt 1 CVEs