Week 50, 2017
11–17 December 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-15944 Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via…EPSS 98%
- Critical 9.8 EPSS 18%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.1
CVE-2017-17562 Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the env…EPSS 97%
-
Unscored
CVE-2017-17405 Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a lo…EPSS 74%
-
Unscored
CVE-2017-17560 An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provide…EPSS 73%
- High 7.5 EPSS 68%
- High 7.5 EPSS 65%
- High 7.5 EPSS 65%
-
Unscored
CVE-2017-11907 Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511…EPSS 65%
-
Unscored
CVE-2017-11918 ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the curren…EPSS 63%
Advisories
- SUSE / openSUSE Security Updates 53
- Debian Security (DSA / DLA) 151 critical
- Ubuntu Security Notices (USN) 4
- Oracle Linux Security Advisories (ELSA) 1
- CERT@VDE 1
- BSI CERT-Bund (WID) 1
- DLA-1205-1 simplesamlphp - security update 6 CVEs