Week 22, 2018
28 May – 3 June 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-11138 The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to e…EPSS 92%
- Critical EPSS 8.4%
- Critical 9.8 EPSS 4.9%
- Critical EPSS 4.7%
- Critical 9.8 EPSS 4.6%
-
Critical 9.8
CVE-2018-11682 Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the St…EPSS 4.2%
-
Critical 9.8
CVE-2018-11681 Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session…EPSS 4.2%
- Critical EPSS 2.5%
- Critical 9.8 EPSS 2.4%
- Critical 9.8 EPSS 2.3%
- Critical 9.8 EPSS 2.2%
- Critical 9.8 EPSS 2.2%
- Critical 9.1 EPSS 2.1%
- Critical EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-11646 webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebK…EPSS 68%
-
Unscored
CVE-2018-11235 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a craft…EPSS 47%
-
Unscored
CVE-2018-11139 The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be ab…EPSS 42%
-
Unscored
CVE-2018-1235 Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated…EPSS 42%
DELL EMC · Dell EMC RecoverPoint Virtual Machine (VM) · Dell EMC RecoverPoint
-
Unscored
CVE-2018-11143 Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).EPSS 36%
-
Unscored
CVE-2018-11552 There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtratio…EPSS 28%
-
Unscored
CVE-2018-11652 CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header,…EPSS 23%
-
Unscored
CVE-2018-11132 In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized w…EPSS 18%
Advisories
- SUSE / openSUSE Security Updates 211 critical
- Debian Security (DSA / DLA) 121 critical
- Ubuntu Security Notices (USN) 72 critical
- CISA ICS & IT advisories 31 critical
- BSI CERT-Bund (WID) 1
- Oracle Linux Security Advisories (ELSA) 1
- USN-3665-1 tomcat7, tomcat8 vulnerabilities 6 CVEs
- ICSA-18-151-03 Yokogawa STARDOM Controllers (Update A) 5 CVEs
- DSA-4215-1 batik - security update 2 CVEs
- SUSE-SU-2018:1478-1 Security update for curl 1 CVEs
- USN-3661-1 batik vulnerability 1 CVEs