Week 20, 2018
14–20 May 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-4939 Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerabilit…EPSS 62%
-
Critical 9.8
CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all originsEPSS 21%
-
Critical 9.9
CVE-2018-11091 An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload…EPSS 3.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2018-1111 DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script i…EPSS 98%
-
Unscored
CVE-2018-9948 This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is requi…EPSS 62%
-
Unscored
CVE-2018-9958 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to ex…EPSS 62%
-
Unscored
CVE-2018-10735 A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.EPSS 42%
-
Unscored
CVE-2018-10736 A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.EPSS 42%
-
Unscored
CVE-2018-10737 A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.EPSS 41%
-
Unscored
CVE-2018-10738 A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.EPSS 41%
-
Medium 5.3
CVE-2017-12128 An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packe…EPSS 40%
Advisories
- SUSE / openSUSE Security Updates 192 critical
- Debian Security (DSA / DLA) 72 critical
- Oracle Linux Security Advisories (ELSA) 72 critical
- CISA ICS & IT advisories 72 critical
- Ubuntu Security Notices (USN) 51 critical
- CERT@VDE 43 critical
- BSI CERT-Bund (WID) 2
- ICSA-18-135-01 Advantech WebAccess 11 CVEs
- ELSA-2018-1415 Critical: firefox security update (Oracle Linux 7) 9 CVEs
- ICSA-18-137-02 PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series 4 CVEs
- SUSE-SU-2018:1323-1 Security update for curl 3 CVEs
- USN-3648-1 curl vulnerabilities 2 CVEs
- SUSE-SU-2018:1327-1 Security update for curl 1 CVEs
- VDE-2018-007 Phoenix Contact: FL SWITCH 3xxx/4xxx/48xx series - Stack-based Buffer Overflow in shared object file 1 CVEs
- VDE-2018-006 Phoenix Contact: FL SWITCH 3xxx/4xxx/48xx series through 1.33 has a Stack-based Buffer Overflow 1 CVEs
- VDE-2018-004 Phoenix Contact: FL SWITCH 3xxx/4xxx/48xx series through 1.33 allows Command Injection 1 CVEs
- DSA-4202-1 curl - security update 1 CVEs