Week 17, 2018
23–29 April 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-2885 An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resultin…EPSS 23%
-
Critical 10.0
CVE-2017-12087 An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an a…EPSS 2%
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 94%
-
Unscored
CVE-2018-1418 IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824.EPSS 51%
-
Unscored
CVE-2018-8716 WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.EPSS 38%
-
Medium 6.6
CVE-2016-9587 Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systemsEPSS 17%
-
Unscored
CVE-2018-7669 An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal…EPSS 17%
-
Unscored
CVE-2018-8880 Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to…EPSS 13%
- Unscored EPSS 13%
-
Unscored
CVE-2018-10517 In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by a…EPSS 12%
Advisories
- Debian Security (DSA / DLA) 191 critical
- SUSE / openSUSE Security Updates 181 critical
- Ubuntu Security Notices (USN) 6
- CISA ICS & IT advisories 6
- Amazon Linux Security Center (ALAS) 41 critical
- Oracle Linux Security Advisories (ELSA) 41 critical
- ALAS2-2018-1002 Critical: java-1.8.0-openjdk security update (Amazon Linux 2) 10 CVEs
- DLA-1358-1 ruby1.9.1 - security update 10 CVEs
- SUSE-SU-2018:1102-1 Security update for python-Django 9 CVEs
- ELSA-2018-1223 Critical: librelp security update (Oracle Linux 7) 1 CVEs