Week 11, 2018

12–18 March 2018

New CVEs: 370
Critical: 8
High: 29
Newly exploited: 0
Advisories: 50
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2018-7750 Paramiko not properly checking authentication before processing other requests
EPSS 27%
Critical 9.8
CVE-2018-1000120 curl FTP path confusion leads to NIL byte out of bounds write
EPSS 12%
Critical 9.8
CVE-2018-8097 Eve allows execution of arbitrary code
EPSS 6.3%
Critical 9.8
CVE-2018-1000134 Weak Password Requirements in UnboundID LDAP SDK
EPSS 4.7%
Critical 9.8
CVE-2018-1000076 RubyGems Improper Verification of Cryptographic Signature vulnerability
EPSS 2.9%
Critical 9.1
CVE-2018-1000132 Mercurial Incorrect Access Control vulnerability
EPSS 2.7%
Critical 9.8
CVE-2017-18239 Exposure of Sensitive information in authentikat-jwt
EPSS 2%
Critical 9.8
CVE-2018-7749 AsyncSSH SSH Server Authentication Bypass
EPSS 1.8%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

ELSA-2018-0527 Critical: firefox security update (Oracle Linux 7) 7 CVEs
DLA-1309-1 curl - security update 3 CVEs
USN-3598-1 curl vulnerabilities 3 CVEs
DSA-4136-1 curl - security update 3 CVEs
ICSA-18-072-04 OSIsoft PI Web API 2 CVEs