Week 33, 2018
13–19 August 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.1
CVE-2018-3937 An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A …EPSS 9.6%
- Critical 9.8 EPSS 4%
- Critical 9.8 EPSS 3.8%
-
Critical 9.1
CVE-2018-3938 An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. …EPSS 3.3%
- Critical 9.8 EPSS 3.3%
- Critical 9.8 EPSS 2.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Medium 5.9
CVE-2018-15473 OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containi…EPSS 99%
-
High 8.8
CVE-2018-8414 A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerabili…EPSS 73%
-
High 7.5
CVE-2018-8355 ChakraCore RCE VulnerabilityEPSS 68%
Microsoft · Microsoft Edge · ChakraCore · Internet Explorer 11
-
Unscored
CVE-2018-8397 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code E…EPSS 68%
Microsoft · Windows 7 · Windows Server 2008 R2 · Windows Server 2008
-
Unscored
CVE-2018-8353 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 67%
-
Medium 4.2
CVE-2018-11770 org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerabilityEPSS 66%
- High 7.5 EPSS 64%
-
High 7.5
CVE-2018-8373 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 62%
Microsoft · Internet Explorer 11 · Internet Explorer 10 · Internet Explorer 9
Advisories
- SUSE / openSUSE Security Updates 73
- Debian Security (DSA / DLA) 162 critical
- Ubuntu Security Notices (USN) 12
- Oracle Linux Security Advisories (ELSA) 7
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 31 critical
- CERT@VDE 2
- ICSA-18-228-01 Emerson DeltaV DCS Workstations 4 CVEs
- DSA-4278-1 jetty9 - security update 3 CVEs
- DLA-1467-1 ruby-zip - security update 1 CVEs