Week 34, 2018

20–26 August 2018

New CVEs: 235
Critical: 18
High: 30
Newly exploited: 0
Advisories: 51
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2018-1000226 Cobbler Improper Validation of Security Tokens
EPSS 13%
Critical 9.8
CVE-2018-3786 Command Injection in egg-scripts
Egg · egg-scripts

EPSS 12%
Critical 10.0
CVE-2018-1722 IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Control or Federation services are running. IB…
IBM · Security Access Manager Appliance

EPSS 8.9%
Critical 9.8
CVE-2015-5243 phpWhois arbitrary code execution via a crafted whois record
EPSS 6.2%
Critical 9.1
CVE-2018-11061 RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulne…
DELL EMC · RSA NetWitness · RSA Security Analytics

EPSS 4.9%
Critical 9.9
CVE-2018-3856 An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device i…
Samsung · Samsung

EPSS 3.4%
Critical 9.9
CVE-2018-3867 An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings…
Samsung · SmartThings Hub STH-ETH-250

EPSS 2%
Critical 9.9
CVE-2018-3903 On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON pa…
Talos · Samsung

EPSS 1.8%
Critical 9.9
CVE-2018-3872 An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware ve…
Samsung · Samsung

EPSS 1.8%
Critical 9.9
CVE-2018-3902 An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices …
Samsung · SmartThings Hub STH-ETH-250

EPSS 1.8%
Critical 10.0
CVE-2018-1000644 Eclipse RDF4j vulnerable to XML External Entity
EPSS 1.7%
Critical 9.9
CVE-2018-3863 On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON pa…
Samsung · SmartThings Hub STH-ETH-250

EPSS 1.7%
Critical 9.9
CVE-2018-3832 An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries …
Insteon · Insteon

EPSS 1.6%
Critical 9.8
CVE-2018-15601 Elefant CMS Improper Input Validation
EPSS 1.6%
Critical 9.9
CVE-2018-3866 An exploitable buffer overflow vulnerability exists in the samsungWifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmwar…
Samsung · Samsung

EPSS 1.5%

All 18 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

ALAS2-2018-1061 Critical: thunderbird security update (Amazon Linux 2) 11 CVEs
ICSMA-18-235-01 BD Alaris Plus 1 CVEs