Week 46, 2017
13–19 November 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 7.2%
- Critical 9.8 EPSS 7.2%
- Critical 9.8 EPSS 6.4%
- Critical 9.8 EPSS 5.1%
- Critical 9.1 EPSS 4.7%
- Critical 9.8 EPSS 4.2%
- Critical 9.8 EPSS 3.1%
- Critical 9.8 EPSS 2.9%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.6%
- Critical EPSS 2.6%
-
Critical 9.3
CVE-2017-5533 TIBCO JasperReports Server credentials disclosureEPSS 2.2%
TIBCO Software · TIBCO JasperReports Server · TIBCO JasperReports Server for ActiveMatrix BPM · TIBCO JasperReports Server - Community Edition
- Critical 9.8 EPSS 2%
-
Critical 9.6
CVE-2017-3891 In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enab…EPSS 1.3%
- Critical 9.8 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2017-11882 Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker t…EPSS 100%
-
Unscored
CVE-2017-12635 Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to subm…EPSS 100%
-
Unscored
CVE-2017-16806 The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal.EPSS 91%
-
Unscored
CVE-2017-12636 CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries…EPSS 91%
-
Unscored
CVE-2017-11873 ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same us…EPSS 70%
-
Unscored
CVE-2017-11861 Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the curr…EPSS 64%
-
Unscored
CVE-2017-11839 Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take control of an affect…EPSS 62%
-
Unscored
CVE-2017-11840 ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the s…EPSS 60%
Advisories
- Debian Security (DSA / DLA) 211 critical
- SUSE / openSUSE Security Updates 10
- CISA ICS & IT advisories 61 critical
- Ubuntu Security Notices (USN) 5
- Oracle Linux Security Advisories (ELSA) 31 critical
- BSI CERT-Bund (WID) 2
- ELSA-2017-3247 Critical: firefox security update (Oracle Linux 7) 3 CVEs
- ICSA-17-320-02 Siemens SICAM 3 CVEs
- DSA-4037-1 jackson-databind - security update 1 CVEs