Week 29, 2018
16–22 July 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 6.7%
-
Critical 9.8
CVE-2018-10870 redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potenti…EPSS 6.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 99%
-
Unscored
CVE-2018-2893 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are…EPSS 70%
-
Unscored
CVE-2018-0707 Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbit…EPSS 59%
-
Medium 5.8
CVE-2018-1612 IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. IBM X-For…EPSS 56%
- Unscored EPSS 55%
-
Unscored
CVE-2018-5006 Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information…EPSS 53%
-
Unscored
CVE-2018-2894 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are …EPSS 50%
-
Unscored
CVE-2018-13862 Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attackers to reset the authentication via the "…EPSS 49%
Advisories
- SUSE / openSUSE Security Updates 184 critical
- Debian Security (DSA / DLA) 16
- CISA ICS & IT advisories 73 critical
- Ubuntu Security Notices (USN) 3
- BSI CERT-Bund (WID) 2
- ICSA-18-200-03 Echelon SmartServer 1, SmartServer 2, SmartServer 3, i.LON 100, i.LON 600 (Update A) 4 CVEs
- SUSE-SU-2018:1996-1 Security update for mercurial 3 CVEs
- SUSE-SU-2018:1990-1 Security update for mercurial 3 CVEs
- SUSE-SU-2018:1998-1 Security update for mercurial 3 CVEs
- ICSA-18-200-02 AVEVA InTouch 1 CVEs
- ICSA-18-200-01 AVEVA InduSoft Web Studio and InTouch Machine Edition 1 CVEs
- SUSE-SU-2018:1971-1 Security update for python-paramiko 1 CVEs