Week 18, 2018
30 April – 6 May 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-10562 An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Fo…EPSS 100%
-
Critical 9.8
CVE-2018-10561 An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that require…EPSS 93%
- Critical 9.8 EPSS 2.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-10583 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection e…EPSS 79%
-
Unscored
CVE-2018-0258 A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directo…EPSS 48%
-
Unscored
CVE-2018-10553 An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with i…EPSS 38%
-
Unscored
CVE-2018-8115 A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a co…EPSS 34%
-
Unscored
CVE-2018-10718 Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute arbitrary code via c…EPSS 31%
-
Unscored
CVE-2016-10036 Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet applic…EPSS 25%
-
Unscored
CVE-2018-0494 GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.EPSS 16%
-
Unscored
CVE-2018-5234 The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execution of arbitrary co…EPSS 15%
Advisories
- Debian Security (DSA / DLA) 121 critical
- SUSE / openSUSE Security Updates 7
- CISA ICS & IT advisories 51 critical
- Oracle Linux Security Advisories (ELSA) 5
- Ubuntu Security Notices (USN) 5
- BSI CERT-Bund (WID) 1
- ICSA-18-123-01 Lantech IDS 2102 2 CVEs
- DSA-4190-1 jackson-databind - security update 1 CVEs