Week 3, 2018
15–21 January 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 17%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-5955 An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unauthenticated attacker to add a user to t…EPSS 82%
-
Unscored
CVE-2018-5712 An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error pa…EPSS 80%
-
Unscored
CVE-2017-18044 A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvau…EPSS 69%
-
Unscored
CVE-2017-14803 In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE1…EPSS 35%
- Medium 6.1 EPSS 30%
-
Unscored
CVE-2018-2616 Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Diagnostic Assistant). The supported version that is affected is Prior …EPSS 27%
-
Unscored
CVE-2018-5726 MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request, as demonstrated by the username, passwo…EPSS 20%
-
Unscored
CVE-2017-14094 A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cr…EPSS 19%
Trend Micro · Trend Micro Smart Protection Server (Standalone)
Advisories
- Debian Security (DSA / DLA) 192 critical
- SUSE / openSUSE Security Updates 183 critical
- BSI CERT-Bund (WID) 6
- Oracle Linux Security Advisories (ELSA) 5
- Ubuntu Security Notices (USN) 4
- CISA ICS & IT advisories 21 critical
- ICSA-18-018-01A ICSA-18-018-01A Siemens SIMATIC WinCC Add-On (Update A) 8 CVEs
- SUSE-SU-2018:0122-1 Security update for curl 2 CVEs
- DLA-1254-1 lucene-solr - security update 1 CVEs
- DLA-1249-1 smarty3 - security update 1 CVEs
- SUSE-SU-2018:0127-1 Security update for mercurial 1 CVEs
- SUSE-SU-2018:0129-1 Security update for mercurial 1 CVEs