Week 21, 2018
21–27 May 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 69%
- Critical 9.8 EPSS 19%
-
Critical 9.1
CVE-2018-1000301 curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tr…EPSS 5.8%
- Critical 9.8 EPSS 4.4%
- Critical 9.8 EPSS 3.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 6.1 EPSS 87%
-
Unscored
CVE-2018-10357 A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code on vulnerable insta…EPSS 64%
-
Medium 5.5
CVE-2018-3639 Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are know…EPSS 60%
- High 8.8 EPSS 31%
-
Unscored
CVE-2018-8176 A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka "Microsoft PowerPoi…EPSS 23%
-
Unscored
CVE-2018-11412 In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances…EPSS 16%
-
Unscored
CVE-2018-10350 A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary …EPSS 14%
Trend Micro · Trend Micro Smart Protection Server (Standalone)
-
Unscored
CVE-2018-6409 An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of …EPSS 14%
Advisories
- SUSE / openSUSE Security Updates 24
- Debian Security (DSA / DLA) 141 critical
- Ubuntu Security Notices (USN) 11
- Oracle Linux Security Advisories (ELSA) 8
- Amazon Linux Security Center (ALAS) 41 critical
- CISA ICS & IT advisories 42 critical
- BSI CERT-Bund (WID) 2
- ICSA-18-142-01 Martem TELEM-GW6/GWM (Update B) 4 CVEs
- ICSA-18-144-01 Schneider Electric Floating License Manager 3 CVEs
- DLA-1385-1 batik - security update 1 CVEs
- ALAS2-2018-1021 Critical: dhcp security update (Amazon Linux 2) 1 CVEs