Week 37, 2018
10–16 September 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 26%
- Critical 9.8 EPSS 3.7%
- Critical 9.8 EPSS 3.6%
-
Critical 9.9
CVE-2018-3875 An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware vers…EPSS 1.5%
-
Critical 9.9
CVE-2018-3896 An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware ve…EPSS 1.5%
-
Critical 9.9
CVE-2018-3897 An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware ve…EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 69%
- High 7.5 EPSS 69%
-
Unscored
CVE-2018-16836 Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary file…EPSS 61%
-
Unscored
CVE-2018-8420 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerab…EPSS 49%
Microsoft · Windows Server 2016 · Windows Server 2012 R2 · Windows Server 2012
-
Unscored
CVE-2018-8464 An remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge PDF Remote Code Executio…EPSS 43%
-
Unscored
CVE-2018-8474 A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Fe…EPSS 38%
-
Unscored
CVE-2018-16288 LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.EPSS 36%
-
Unscored
CVE-2018-8421 A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability."…EPSS 29%
Advisories
- SUSE / openSUSE Security Updates 211 critical
- Debian Security (DSA / DLA) 161 critical
- CISA ICS & IT advisories 61 critical
- Ubuntu Security Notices (USN) 5
- Amazon Linux Security Center (ALAS) 4
- Oracle Linux Security Advisories (ELSA) 41 critical
- BSI CERT-Bund (WID) 1
- DLA-1500-1 openssh - security update 12 CVEs
- ELSA-2018-2692 Critical: firefox security update (Oracle Linux 7) 5 CVEs
- SUSE-SU-2018:2699-1 Security update for tomcat 4 CVEs
- ICSA-18-254-04 ICSA-18-254-04 Siemens SIMATIC WinCC OA 1 CVEs