Week 30, 2018
23–29 July 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.9
CVE-2017-2637 A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by defaul…EPSS 4.6%
-
Critical 9.8
CVE-2018-8859 Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can b…EPSS 1.6%
-
Critical 9.8
CVE-2018-8851 Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store…EPSS 1.3%
-
Critical 9.8
CVE-2018-10627 Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can u…EPSS 1.2%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 87%
-
High 7.5
CVE-2017-15120 An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a special…EPSS 51%
-
Unscored
CVE-2018-14493 Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via th…EPSS 41%
- Unscored EPSS 24%
- High 8.8 EPSS 18%
- Medium 5.5 EPSS 13%
-
Medium 6.5
CVE-2018-14335 An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permi…EPSS 13%
-
High 7.4
CVE-2017-12150 It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enable…EPSS 13%
Advisories
- SUSE / openSUSE Security Updates 651 critical
- Debian Security (DSA / DLA) 211 critical
- Ubuntu Security Notices (USN) 7
- BSI CERT-Bund (WID) 6
- Oracle Linux Security Advisories (ELSA) 3
- Amazon Linux Security Center (ALAS) 3
- DLA-1414-2 mercurial - regression update 1 CVEs
- SUSE-SU-2018:2047-1 Security update for python-dulwich 1 CVEs