Week 19, 2018
7–13 May 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 11%
-
Critical 9.8
CVE-2018-10682 An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication …EPSS 8.1%
-
Critical 9.8
CVE-2017-14475 In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM prot…EPSS 6.1%
-
Critical 9.8
CVE-2017-14474 In the MMM::Agent::Helpers::_execute function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1, a specially crafted MMM protocol message can ca…EPSS 6.1%
-
Critical 9.8
CVE-2017-14478 In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM pr…EPSS 6%
-
Critical 9.8
CVE-2017-14480 In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM …EPSS 6%
-
Critical 9.8
CVE-2017-14477 In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM pr…EPSS 6%
-
Critical 9.8
CVE-2017-14476 In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM pr…EPSS 6%
-
Critical 9.8
CVE-2017-14479 In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM …EPSS 6%
-
Critical 9.8
CVE-2017-14481 In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM …EPSS 5.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2018-8174 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 88%
Microsoft · Windows Server 2016 · Windows Server 2012 R2 · Windows Server 2012
-
High 7.0
CVE-2018-8120 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 73%
Microsoft · Windows 7 · Windows Server 2008 R2 · Windows Server 2008
-
High 7.5
CVE-2018-0824 A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows…EPSS 73%
-
High 7.5
CVE-2018-8145 ChakraCore information disclosure vulnerabilityEPSS 67%
Microsoft · Microsoft Edge · ChakraCore · Internet Explorer 11
-
Unscored
CVE-2018-0953 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor…EPSS 66%
- High 7.5 EPSS 66%
-
Unscored
CVE-2015-1503 Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the fi…EPSS 57%
- High 7.5 EPSS 51%
Advisories
- SUSE / openSUSE Security Updates 77
- Debian Security (DSA / DLA) 11
- Amazon Linux Security Center (ALAS) 91 critical
- Ubuntu Security Notices (USN) 8
- CISA ICS & IT advisories 3
- Oracle Linux Security Advisories (ELSA) 3
- BSI CERT-Bund (WID) 1
- ALAS2-2018-1007 Critical: java-1.7.0-openjdk security update (Amazon Linux 2) 10 CVEs