Week 36, 2018
3–9 September 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 74%
-
Critical 9.8
CVE-2018-1567 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialize…EPSS 3.7%
- Critical 9.8 EPSS 2.9%
- Critical 9.8 EPSS 2.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-16509 An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be…EPSS 92%
-
Unscored
CVE-2018-16763 FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Executio…EPSS 83%
-
Unscored
CVE-2018-16144 The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to impr…EPSS 33%
-
Unscored
CVE-2018-5391 The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packetsEPSS 32%
-
Unscored
CVE-2018-16059 Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.EPSS 29%
-
High 7.5
CVE-2018-14618 curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the le…EPSS 11%
-
High 7.5
CVE-2018-1756 IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statemen…EPSS 10%
-
Unscored
CVE-2018-1000773 WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an…EPSS 8.2%
Advisories
- SUSE / openSUSE Security Updates 183 critical
- Debian Security (DSA / DLA) 141 critical
- BSI CERT-Bund (WID) 5
- Ubuntu Security Notices (USN) 3
- CISA ICS & IT advisories 2
- Oracle Linux Security Advisories (ELSA) 2
- SUSE-RU-2018:2639-1 Recommended update for SUSE Manager 3.1 Release Notes 3 CVEs
- SUSE-SU-2018:2608-1 Security update for cobbler 3 CVEs
- SUSE-SU-2018:2629-1 Security update for curl 2 CVEs
- DLA-1492-1 dojo - security update 1 CVEs