Week 26, 2018
25 June – 1 July 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 10.0 EPSS 81%
- Critical 9.1 EPSS 80%
-
Critical 9.8
CVE-2017-7658 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)EPSS 19%
- Critical 9.8 EPSS 14%
- Critical 9.8 EPSS 5.6%
- Critical 9.8 EPSS 4.3%
- Critical 9.8 EPSS 4.2%
- Critical 10.0 EPSS 3.5%
-
Critical 9.6
CVE-2018-5435 TIBCO Spotfire Product Family Remote Code Execution VulnerabilityEPSS 3.2%
TIBCO Software · TIBCO Spotfire Analytics Platform for AWS Marketplace · TIBCO Spotfire Desktop · TIBCO Spotfire Analyst
-
Critical 9.0
CVE-2017-7465 It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause r…EPSS 2.8%
- Critical 9.8 EPSS 2.3%
- Critical 9.8 EPSS 2.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-12998 A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 1231…EPSS 99%
-
High 8.8
CVE-2018-1000600 CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentialsEPSS 91%
-
Unscored
CVE-2018-10661 An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.EPSS 86%
-
Unscored
CVE-2018-10660 An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.EPSS 82%
-
Unscored
CVE-2018-10662 An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.EPSS 79%
-
Unscored
CVE-2018-1000533 klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result i…EPSS 73%
-
Unscored
CVE-2018-10594 Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHS…EPSS 68%
ICS-CERT · Delta Industrial Automation COMMGR and accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1)
-
Unscored
CVE-2018-12895 WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is pass…EPSS 62%
Advisories
- SUSE / openSUSE Security Updates 212 critical
- Debian Security (DSA / DLA) 193 critical
- Oracle Linux Security Advisories (ELSA) 4
- Ubuntu Security Notices (USN) 3
- CISA ICS & IT advisories 2
- Amazon Linux Security Center (ALAS) 1
- BSI CERT-Bund (WID) 1
- SUSE-SU-2018:1835-1 Security update for tiff 13 CVEs
- DLA-1400-1 tomcat7 - security update 5 CVEs
- DLA-1408-1 simplesamlphp - security update 2 CVEs
- SUSE-SU-2018:1850-1 Security update for python-paramiko 1 CVEs
- DLA-1403-1 zendframework - security update 1 CVEs