Week 25, 2018
18–24 June 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 19%
- Critical 9.8 EPSS 6.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 98%
-
Unscored
CVE-2018-12634 CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.EPSS 56%
-
Unscored
CVE-2018-12636 The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.EPSS 29%
-
Unscored
CVE-2018-12692 TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the…EPSS 28%
-
Unscored
CVE-2018-12327 Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long …EPSS 28%
-
Unscored
CVE-2018-12617 qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_mall…EPSS 25%
-
Unscored
CVE-2015-4664 An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.EPSS 20%
- Unscored EPSS 17%
Advisories
- SUSE / openSUSE Security Updates 225 critical
- Ubuntu Security Notices (USN) 5
- Debian Security (DSA / DLA) 5
- Amazon Linux Security Center (ALAS) 3
- CISA ICS & IT advisories 2
- BSI CERT-Bund (WID) 2
- Oracle Linux Security Advisories (ELSA) 1
- SUSE-SU-2018:1751-1 Security update for SUSE Manager Server 3.1 2 CVEs
- SUSE-SU-2018:1757-1 Security update for salt 2 CVEs
- SUSE-SU-2018:1736-1 Security update for cobbler 1 CVEs
- SUSE-SU-2018:1744-1 Security update for slf4j 1 CVEs
- SUSE-SU-2018:1741-1 Security update for cobbler 1 CVEs