Week 9, 2018
26 February – 4 March 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 20%
- Critical 9.8 EPSS 4.8%
- Critical 9.9 EPSS 1.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-7584 In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP respo…EPSS 87%
- High 7.5 EPSS 69%
-
Unscored
CVE-2018-7573 An issue was discovered in FTPShell Client 6.7. A remote FTP server can send 400 characters of 'F' in conjunction with the FTP 220 response code to crash the a…EPSS 69%
-
Unscored
CVE-2018-7662 Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.EPSS 47%
-
Unscored
CVE-2018-4904 An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. …EPSS 43%
-
Unscored
CVE-2018-7583 Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.EPSS 38%
-
Medium 6.6
CVE-2018-2380 SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters repres…EPSS 29%
-
Unscored
CVE-2018-4879 An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. …EPSS 29%
Advisories
- SUSE / openSUSE Security Updates 35
- Debian Security (DSA / DLA) 154 critical
- CISA ICS & IT advisories 72 critical
- Oracle Linux Security Advisories (ELSA) 5
- Ubuntu Security Notices (USN) 2
- BSI CERT-Bund (WID) 2
- ICSMA-18-058-02 Philips Intellispace Portal ISP Vulnerabilities 35 CVEs
- DSA-4127-1 simplesamlphp - security update 9 CVEs
- DLA-1298-1 simplesamlphp - security update 3 CVEs
- ICSA-18-060-02 Moxa OnCell G3100-HSPA Series 3 CVEs
- DSA-4124-1 lucene-solr - security update 2 CVEs
- DLA-1299-1 libjgraphx-java - security update 1 CVEs