Week 28, 2018

9–15 July 2018

New CVEs: 749
Critical: 14
High: 38
Newly exploited: 0
Advisories: 63
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2018-14009 Codiad remote code execution vulnerability
EPSS 38%
Critical 9.8
CVE-2018-8319 Sensitive Data Exposure in msrcrypto
Microsoft · Microsoft Research JavaScript Cryptography Library

EPSS 7.7%
Critical 9.8
CVE-2018-13797 Command Injection in macaddress
EPSS 6.7%
Critical 9.8
CVE-2018-1337 Credential leak in org.apache.directory.api:apache-ldap-api
Apache Software Foundation · Apache Directory

EPSS 5.2%
Critical 9.8
CVE-2018-1000613 Deserialization of Untrusted Data in Bouncy castle
EPSS 4.8%
Critical 9.8
CVE-2018-0037 Junos OS: RPD daemon crashes due to receipt of crafted BGP NOTIFICATION messages
Juniper Networks · Junos OS

EPSS 3.7%
Critical 9.0
CVE-2018-1245 Authorization ByPass Vulnerability
RSA · RSA Identity Governance and Lifecycle

EPSS 2.5%
Critical 9.8
CVE-2018-5553 Crestron DGE-100 Console Command Injection (FIXED)
Crestron · DM-DGE-200-C · TS-1542-C · DGE-100

EPSS 2.5%
Critical 9.8
CVE-2018-14065 PHPOffice Common Improper Restriction of XML External Entity Reference
EPSS 2.2%
Critical 9.8
CVE-2018-1000620 Insufficient Entropy in cryptiles
EPSS 1.7%
Critical 9.8
CVE-2018-0040 Contrail Service Orchestration: hardcoded cryptographic certificates and keys
Juniper Networks · Contrail Service Orchestration

EPSS 1.4%
Critical 9.3
CVE-2018-10895 Qutebrowser CSRF Vulnerability
qutebrowser · cross-site request forgery flaw allows sites to access 'qute

EPSS 1.2%
Critical 9.8
CVE-2018-0041 Contrail Service Orchestration: Hardcoded credentials for Keystone service.
Juniper Networks · Contrail Service Orchestration

EPSS 1.1%
Critical 9.1
GHSA-hxxf-q3w9-4xgw Malicious Package in eslint-scope

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Unscored
CVE-2018-4993 Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an NTLM SSO hash theft vulnerabil…
EPSS 87%
Unscored
CVE-2016-6563 D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action
D-Link · DIR-868L · DIR-895L · DIR-822

EPSS 80%
High 7.5
CVE-2018-8298 ChakraCore RCE Vulnerability
Microsoft · ChakraCore

EPSS 75%
Unscored
CVE-2017-16709 Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute…
EPSS 74%
Unscored
CVE-2018-8279 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…
Microsoft · Microsoft Edge · ChakraCore

EPSS 71%
High 7.5
CVE-2018-8288 ChakraCore RCE Vulnerability
Microsoft · Microsoft Edge · ChakraCore · Internet Explorer 11

EPSS 69%
High 7.5
CVE-2018-8291 ChakraCore RCE Vulnerability
Microsoft · Microsoft Edge · ChakraCore · Internet Explorer 11

EPSS 69%
High 7.2
CVE-2018-1000207 MODX Revolution Incorrect Access Control vulnerability
EPSS 64%

Advisories

DLA-1421-1 ruby2.1 - security update 25 CVEs
ICSA-18-191-01 Universal Robots Robot Controllers 2 CVEs