Week 16, 2018
16–22 April 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-2628 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are…EPSS 100%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.1%
-
Critical 9.6
CVE-2017-2871 Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is …EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-9059 Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious login request to forum.…EPSS 77%
-
Unscored
CVE-2018-8735 Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target syst…EPSS 64%
-
Unscored
CVE-2018-1143 A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to twonky_comman…EPSS 54%
Belkin · N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
-
Unscored
CVE-2018-8734 SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via …EPSS 54%
-
Unscored
CVE-2018-8831 A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim…EPSS 52%
-
High 7.7
CVE-2018-5430 TIBCO JasperReports Server Information Disclosure VulnerabilityEPSS 48%
TIBCO Software · TIBCO JasperReports Server · TIBCO JasperReports Server for ActiveMatrix BPM · TIBCO JasperReports Server - Community Edition
-
Unscored
CVE-2018-8736 A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.EPSS 46%
-
Unscored
CVE-2018-10201 An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside the root…EPSS 44%
Advisories
- SUSE / openSUSE Security Updates 651 critical
- Debian Security (DSA / DLA) 16
- Oracle Linux Security Advisories (ELSA) 151 critical
- CISA ICS & IT advisories 74 critical
- Amazon Linux Security Center (ALAS) 51 critical
- Ubuntu Security Notices (USN) 4
- BSI CERT-Bund (WID) 3
- ELSA-2018-1191 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 10 CVEs
- SUSE-SU-2018:0973-1 Security update for python-Django 8 CVEs
- ICSA-18-107-04 Rockwell Automation Stratix and ArmorStratix Switches 8 CVEs
- ICSA-18-107-03 ICSA-18-107-03_Rockwell Automation Stratix Services Router 4 CVEs
- ICSA-18-107-02 Schneider Electric Triconex Tricon 2 CVEs
- ALAS2-2018-998 Critical: librelp security update (Amazon Linux 2) 1 CVEs
- ICSA-18-107-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 1 CVEs