Week 24, 2018
11–17 June 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-3202 The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary clas…EPSS 8.1%
- Critical 9.8 EPSS 2.4%
-
Critical 9.8
CVE-2018-2424 SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that…EPSS 2.3%
SAP · SAP HANA database · SAP UI · SAP UI5
-
Critical 9.0
CVE-2018-1085 openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotat…EPSS 2.3%
- Critical 9.8 EPSS 1.9%
-
Critical 9.8
CVE-2018-11574 Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authen…EPSS 1.9%
- Critical 9.8 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2016-9079 A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox a…EPSS 87%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
High 8.1
CVE-2018-6961 VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled…EPSS 85%
- High 7.5 EPSS 71%
-
Unscored
CVE-2018-11218 Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stac…EPSS 59%
-
Unscored
CVE-2018-8239 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 57%
Microsoft · Windows Server 2016 · Windows 10 · Windows 10 Servers
- Unscored EPSS 47%
-
Unscored
CVE-2017-5375 JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird <…EPSS 34%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
Unscored
CVE-2018-11690 The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supp…EPSS 33%
Advisories
- SUSE / openSUSE Security Updates 26
- Ubuntu Security Notices (USN) 181 critical
- Debian Security (DSA / DLA) 6
- Oracle Linux Security Advisories (ELSA) 5
- CISA ICS & IT advisories 42 critical
- BSI CERT-Bund (WID) 3
- Siemens ProductCERT 1
- USN-3685-1 ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities 9 CVEs
- ICSMA-18-165-01 Natus Xltek NeuroWorks 8 CVEs
- ICSA-18-163-01 Schneider Electric U.motion Builder 4 CVEs