Week 10, 2018
5–11 March 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-6530 OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L…EPSS 97%
- Critical 9.8 EPSS 23%
-
Critical 9.8
CVE-2018-0147 A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote at…EPSS 18%
- Critical 9.8 EPSS 2.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-1000115 Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the mem…EPSS 88%
-
Unscored
CVE-2018-7890 A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do end…EPSS 79%
-
Unscored
CVE-2018-7739 antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by…EPSS 53%
-
Unscored
CVE-2018-7582 WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.EPSS 36%
-
Unscored
CVE-2018-7182 The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 pa…EPSS 29%
-
Unscored
CVE-2018-8057 A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel …EPSS 22%
-
Unscored
CVE-2018-1216 A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA …EPSS 21%
-
Unscored
CVE-2018-7665 An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_uploader.php or actio…EPSS 16%
Advisories
- SUSE / openSUSE Security Updates 281 critical
- Ubuntu Security Notices (USN) 10
- Debian Security (DSA / DLA) 9
- CISA ICS & IT advisories 5
- Oracle Linux Security Advisories (ELSA) 4
- BSI CERT-Bund (WID) 4
- Siemens ProductCERT 1
- Amazon Linux Security Center (ALAS) 1
- SUSE-SU-2018:0605-1 Security update for ansible 1 CVEs