Week 51, 2017
18–24 December 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.9%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-17411 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit th…EPSS 88%
-
Unscored
CVE-2017-17105 Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injecti…EPSS 85%
-
Unscored
CVE-2017-17692 Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that re…EPSS 79%
-
Unscored
CVE-2017-17850 An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dia…EPSS 75%
-
Unscored
CVE-2017-5255 In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenti…EPSS 74%
-
Unscored
CVE-2012-2576 SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backu…EPSS 60%
-
Unscored
CVE-2017-5254 In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for o…EPSS 52%
-
Unscored
CVE-2017-17733 Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.EPSS 44%
Advisories
- SUSE / openSUSE Security Updates 192 critical
- Debian Security (DSA / DLA) 18
- CISA ICS & IT advisories 7
- BSI CERT-Bund (WID) 1
- SUSE-SU-2017:3381-1 Security update for Salt 2 CVEs
- SUSE-SU-2017:3380-1 Security update for Salt 2 CVEs