Week 23, 2018
4–10 June 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 10%
- Critical EPSS 5.1%
- Critical 9.8 EPSS 4.5%
- Critical 10.0 EPSS 3.4%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.4%
- Critical 9.1 EPSS 1.7%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2018-0296 A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device…EPSS 100%
-
Unscored
CVE-2018-11409 Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discover…EPSS 98%
-
Unscored
CVE-2018-11714 An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 …EPSS 67%
-
High 8.8
CVE-2018-4233 An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTu…EPSS 54%
-
Unscored
CVE-2018-12054 Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.EPSS 40%
-
Unscored
CVE-2018-10088 Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.EPSS 40%
- High 8.8 EPSS 27%
-
Unscored
CVE-2018-12031 Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the f…EPSS 19%
Advisories
- SUSE / openSUSE Security Updates 611 critical
- Amazon Linux Security Center (ALAS) 111 critical
- Debian Security (DSA / DLA) 81 critical
- Ubuntu Security Notices (USN) 7
- CISA ICS & IT advisories 31 critical
- Oracle Linux Security Advisories (ELSA) 1
- BSI CERT-Bund (WID) 1
- ALAS2-2018-1032 Critical: thunderbird security update (Amazon Linux 2) 12 CVEs
- DSA-4219-1 jruby - security update 7 CVEs
- ICSA-18-156-01 ABB IP Gateway 3 CVEs
- SUSE-SU-2018:1601-1 Security update for memcached 2 CVEs