Week 12, 2018
19–25 March 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-7445 A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service …EPSS 66%
- Critical 9.8 EPSS 15%
-
Critical 9.8
CVE-2017-1789 IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods. IBM X-Force ID: 137034.EPSS 3.2%
- Critical 9.8 EPSS 1.9%
- Critical 9.0 EPSS 1.6%
- Critical 9.8 EPSS 1.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-1207 Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated …EPSS 90%
-
Unscored
CVE-2017-17215 Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to l…EPSS 78%
-
Unscored
CVE-2017-17736 Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then na…EPSS 68%
-
Unscored
CVE-2018-7422 A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_pat…EPSS 62%
- Unscored EPSS 47%
-
Unscored
CVE-2018-8828 A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malfor…EPSS 30%
- Medium 4.9 EPSS 20%
- High 7.2 EPSS 18%
Advisories
- SUSE / openSUSE Security Updates 172 critical
- Debian Security (DSA / DLA) 122 critical
- Ubuntu Security Notices (USN) 61 critical
- CISA ICS & IT advisories 41 critical
- Amazon Linux Security Center (ALAS) 21 critical
- BSI CERT-Bund (WID) 2
- Siemens ProductCERT 1
- Oracle Linux Security Advisories (ELSA) 11 critical
- Schneider Electric CPCERT 1
- CERT@VDE 1
- SUSE-SU-2018:0778-1 Security update for memcached 9 CVEs
- ICSA-18-079-01 Geutebruck IP Cameras 6 CVEs
- SUSE-SU-2018:0769-1 Security update for curl 3 CVEs
- ALAS2-2018-981 Critical: libvorbis security update (Amazon Linux 2) 1 CVEs
- DSA-4149-1 plexus-utils2 - security update 1 CVEs
- USN-3603-1 paramiko vulnerability 1 CVEs
- DSA-4146-1 plexus-utils - security update 1 CVEs
- ELSA-2018-0549 Critical: firefox security update (Oracle Linux 7) 1 CVEs