Week 2, 2018
8–14 January 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2018-0798 Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability …EPSS 95%
-
High 7.8
CVE-2018-0802 Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability d…EPSS 93%
-
Unscored
CVE-2018-5347 Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs…EPSS 54%
-
Unscored
CVE-2014-6436 Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic…EPSS 42%
-
Unscored
CVE-2018-5371 diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers…EPSS 42%
-
Unscored
CVE-2018-5262 A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in the context of a hig…EPSS 39%
-
Unscored
CVE-2017-16887 The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t…EPSS 37%
-
Unscored
CVE-2017-16885 Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usage, Changing Passw…EPSS 33%
Advisories
- SUSE / openSUSE Security Updates 241 critical
- Debian Security (DSA / DLA) 192 critical
- Ubuntu Security Notices (USN) 161 critical
- CISA ICS & IT advisories 41 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 3
- CERT@VDE 11 critical
- Amazon Linux Security Center (ALAS) 11 critical
- USN-3519-1 tomcat7, tomcat8 vulnerabilities 4 CVEs
- SUSE-SU-2018:0065-1 Fixing security issues on OBS toolchain 3 CVEs
- ALAS2-2018-939 Critical: kernel security update (Amazon Linux 2) 2 CVEs
- ICSA-18-011-03 PHOENIX CONTACT FL SWITCH 2 CVEs
- VDE-2017-006 PHOENIX CONTACT: FL SWITCH 3xxx/4xxx/48xx series web-service authentication bypass 2 CVEs
- DLA-1236-1 plexus-utils - security update 1 CVEs
- DLA-1237-1 plexus-utils2 - security update 1 CVEs