Week 35, 2018
27 August – 2 September 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 63%
-
Critical 9.8
CVE-2018-7790 An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). Th…EPSS 2.4%
Schneider Electric · Modicon M221, all references, all versions prior to firmware V1.6.2.0
-
Critical 9.8
CVE-2018-7791 A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware…EPSS 1.9%
Schneider Electric · Modicon M221, all references, all versions prior to firmware V1.6.2.0
-
Critical 9.9
CVE-2018-3895 An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 Firmw…EPSS 1.8%
-
Critical 9.9
CVE-2018-3893 An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Fir…EPSS 1.8%
-
Critical 9.9
CVE-2018-3904 An exploitable buffer overflow vulnerability exists in the camera 'update' feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmwar…EPSS 1.8%
-
Critical 9.1
CVE-2018-3908 An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The vid…EPSS 1.3%
- Critical 9.1 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-15745 Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE param…EPSS 98%
-
Unscored
CVE-2018-12710 An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, …EPSS 77%
-
Unscored
CVE-2018-16159 The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template…EPSS 49%
-
Unscored
CVE-2018-16323 ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affect…EPSS 49%
- Unscored EPSS 45%
- Unscored EPSS 39%
-
Unscored
CVE-2018-12827 Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.EPSS 32%
-
Unscored
CVE-2018-16158 Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not proper…EPSS 30%
Advisories
- SUSE / openSUSE Security Updates 293 critical
- Debian Security (DSA / DLA) 16
- CISA ICS & IT advisories 62 critical
- Ubuntu Security Notices (USN) 5
- BSI CERT-Bund (WID) 4
- Oracle Linux Security Advisories (ELSA) 1
- SUSE-SU-2018:2561-1 Security update for cobbler 3 CVEs
- SUSE-SU-2018:2551-1 Security update for cobbler 3 CVEs
- SUSE-SU-2018:2550-1 Security update for cobbler 1 CVEs
- ICSMA-18-240-01 ICSMA-18-240-01_Qualcomm Life Capsule 1 CVEs
- ICSA-18-240-04 ABB eSOMS (Update A) 1 CVEs