Week 15, 2018
9–15 April 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 97%
- Critical 9.8 EPSS 58%
-
Critical 10.0
CVE-2017-14459 An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wi…EPSS 13%
- Critical 9.8 EPSS 4.1%
-
Critical 9.8
CVE-2017-0359 diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archiveEPSS 2.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-9995 TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-bran…EPSS 82%
- High 7.5 EPSS 66%
-
Unscored
CVE-2018-1217 Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a …EPSS 51%
-
Unscored
CVE-2018-9118 exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename …EPSS 46%
-
Unscored
CVE-2018-1026 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 41%
-
Unscored
CVE-2018-1010 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 40%
- High 8.8 EPSS 34%
-
Unscored
CVE-2018-1030 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 24%
Advisories
- Debian Security (DSA / DLA) 12
- SUSE / openSUSE Security Updates 111 critical
- Ubuntu Security Notices (USN) 4
- CISA ICS & IT advisories 41 critical
- BSI CERT-Bund (WID) 1
- Oracle Linux Security Advisories (ELSA) 1
- ICSA-18-102-02 Rockwell Automation FactoryTalk Activation Manager (Update B) 2 CVEs
- SUSE-SU-2018:0933-1 Security update for mercurial 1 CVEs