Week 27, 2018
2–8 July 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 3.9%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.1%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.9%
- Critical 9.1 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.2
CVE-2018-9276 An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative pri…EPSS 87%
-
Unscored
CVE-2018-8046 The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework bri…EPSS 66%
-
Unscored
CVE-2018-13050 A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST…EPSS 39%
-
Unscored
CVE-2018-13109 All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerability where attackers are able to access a…EPSS 35%
-
Unscored
CVE-2018-7777 The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software version…EPSS 32%
-
Unscored
CVE-2018-12571 uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrar…EPSS 30%
- High 7.5 EPSS 13%
-
High
CVE-2018-8038 High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cx…EPSS 10%
Advisories
- Ubuntu Security Notices (USN) 15
- SUSE / openSUSE Security Updates 14
- Debian Security (DSA / DLA) 122 critical
- CERT@VDE 2
- BSI CERT-Bund (WID) 2
- Oracle Linux Security Advisories (ELSA) 21 critical
- CISA ICS & IT advisories 1
- DLA-1415-1 phpmyadmin - security update 11 CVEs
- ELSA-2018-2113 Critical: firefox security update (Oracle Linux 7) 11 CVEs
- DLA-1414-1 mercurial - security update 6 CVEs