Week 14, 2018
2–8 April 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 78%
-
Critical 10.0
CVE-2017-14463 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 39%
-
Critical 10.0
CVE-2017-14472 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14469 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14471 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14466 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14470 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14473 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14468 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14464 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 38%
-
Critical 10.0
CVE-2017-14467 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 37%
-
Critical 10.0
CVE-2017-14462 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 35%
-
Critical 10.0
CVE-2017-14465 An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B …EPSS 35%
-
Critical 9.8
CVE-2018-1295 Apache serialization mechanism does not have a list of classes allowed for serialization/deserializationEPSS 6.3%
- Critical 9.1 EPSS 5.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-0986 A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory co…EPSS 63%
Microsoft · Microsoft Exchange Server · Microsoft Security Essentials · Microsoft System Center
-
Unscored
CVE-2018-9205 Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.EPSS 55%
-
Unscored
CVE-2018-9126 The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via…EPSS 49%
-
Unscored
CVE-2018-4162 An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTune…EPSS 38%
- Medium 5.9 EPSS 30%
-
Unscored
CVE-2018-8719 An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. …EPSS 16%
-
Unscored
CVE-2018-9248 FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.EPSS 14%
-
Unscored
CVE-2018-9230 In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the…EPSS 13%
Advisories
- SUSE / openSUSE Security Updates 211 critical
- Ubuntu Security Notices (USN) 111 critical
- Debian Security (DSA / DLA) 10
- Amazon Linux Security Center (ALAS) 6
- Oracle Linux Security Advisories (ELSA) 2
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 2
- Schneider Electric CPCERT 1
- USN-3621-1 ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities 7 CVEs
- SUSE-SU-2018:0873-1 Security update for python-paramiko 1 CVEs