Week 42, 2017
16–22 October 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 3.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2017-10271 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6…EPSS 100%
-
Unscored
CVE-2014-9118 The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip…EPSS 53%
-
Unscored
CVE-2017-10366 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that …EPSS 43%
-
Unscored
CVE-2017-12285 A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from a…EPSS 37%
-
Unscored
CVE-2017-14322 The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to byp…EPSS 37%
-
Unscored
CVE-2017-15647 On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.EPSS 27%
-
Unscored
CVE-2017-10355 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java S…EPSS 16%
-
Unscored
CVE-2015-2780 Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable exte…EPSS 15%
Advisories
- SUSE / openSUSE Security Updates 53
- Debian Security (DSA / DLA) 161 critical
- BSI CERT-Bund (WID) 4
- CISA ICS & IT advisories 4
- Oracle Linux Security Advisories (ELSA) 31 critical
- Ubuntu Security Notices (USN) 2
- ELSA-2017-2998 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 14 CVEs
- DSA-4004-1 jackson-databind - security update 1 CVEs