Week 47, 2017
20–26 November 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 8.6%
- Critical 9.8 EPSS 3.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-16894 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env…EPSS 87%
-
Unscored
CVE-2017-16944 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack ex…EPSS 63%
-
Unscored
CVE-2017-16943 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (…EPSS 47%
-
Unscored
CVE-2017-16934 The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtd…EPSS 13%
-
Unscored
CVE-2017-15088 plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attac…EPSS 8.6%
-
Unscored
CVE-2017-16902 On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or loginUsername field to goform/login causes …EPSS 8%
-
Unscored
CVE-2017-16935 Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions vi…EPSS 7.7%
- High 7.5 EPSS 6.5%
Advisories
- Debian Security (DSA / DLA) 181 critical
- SUSE / openSUSE Security Updates 16
- Ubuntu Security Notices (USN) 12
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 2
- Siemens ProductCERT 1
- DSA-4044-1 swauth - security update 1 CVEs