Week 38, 2018
17–23 September 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 6.2%
-
Critical 9.8
CVE-2017-2877 A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted r…EPSS 1.9%
-
Critical 9.9
CVE-2018-3876 An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware vers…EPSS 1.9%
-
Critical 9.9
CVE-2018-3865 An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmwa…EPSS 1.8%
-
Critical 9.9
CVE-2018-3894 An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmw…EPSS 1.8%
-
Critical 9.9
CVE-2018-3873 An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware vers…EPSS 1.8%
-
Critical 9.9
CVE-2018-3877 An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware vers…EPSS 1.8%
-
Critical 9.9
CVE-2018-3864 An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmwa…EPSS 1.8%
-
Critical 9.9
CVE-2018-3874 An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware vers…EPSS 1.8%
-
Critical 9.6
CVE-2017-14443 An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number…EPSS 1.8%
-
Critical 9.9
CVE-2017-2872 Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A HTTP request can …EPSS 1.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-17153 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker c…EPSS 87%
-
Unscored
CVE-2018-17254 The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.EPSS 83%
-
Unscored
CVE-2018-17243 Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.EPSS 75%
-
Unscored
CVE-2018-17128 A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.EPSS 75%
-
Unscored
CVE-2018-17283 Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=…EPSS 66%
-
Unscored
CVE-2018-16833 Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI.EPSS 65%
-
Unscored
CVE-2018-17207 An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can…EPSS 60%
-
Unscored
CVE-2018-17173 LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.EPSS 57%
Advisories
- Debian Security (DSA / DLA) 18
- SUSE / openSUSE Security Updates 161 critical
- Ubuntu Security Notices (USN) 8
- Amazon Linux Security Center (ALAS) 3
- CISA ICS & IT advisories 31 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 1
- CERT@VDE 1
- ICSA-18-263-02 Rockwell Automation RSLinx Classic 3 CVEs
- SUSE-SU-2018:2777-1 Security update for python-paramiko 1 CVEs