Week 39, 2018
24–30 September 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-15961 Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Su…EPSS 100%
-
Critical 9.8
CVE-2018-15957 Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi…EPSS 28%
-
Critical 9.8
CVE-2018-15531 JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.EPSS 28%
-
Critical 9.8
CVE-2018-15958 Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi…EPSS 26%
-
Critical 9.8
CVE-2018-15965 Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi…EPSS 26%
-
Critical 9.8
CVE-2018-15959 Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi…EPSS 26%
-
Critical 9.8
CVE-2018-15764 Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution vulnerability due to improper configurations of triggered JMX services. A r…EPSS 5.3%
-
Critical 10.0
CVE-2018-3972 An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as used in Monero 'Lithium Luna' (v0.12.2.0-…EPSS 3.7%
- Critical 9.8 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-16283 The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.EPSS 64%
-
Unscored
CVE-2018-17281 There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and …EPSS 52%
-
Unscored
CVE-2018-11763 In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any c…EPSS 51%
-
Unscored
CVE-2018-16299 The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.EPSS 44%
-
Unscored
CVE-2018-12848 Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds write vulnerabil…EPSS 35%
-
Unscored
CVE-2018-12849 Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili…EPSS 34%
-
Unscored
CVE-2018-12850 Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili…EPSS 34%
-
Unscored
CVE-2018-12840 Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili…EPSS 29%
Advisories
- SUSE / openSUSE Security Updates 462 critical
- Debian Security (DSA / DLA) 14
- Oracle Linux Security Advisories (ELSA) 8
- CISA ICS & IT advisories 43 critical
- Ubuntu Security Notices (USN) 3
- BSI CERT-Bund (WID) 1
- SUSE-SU-2018:2899-1 Security update for smt 3 CVEs
- SUSE-SU-2018:2898-1 Security update for smt, yast2-smt 3 CVEs
- ICSA-18-270-03 Fuji Electric FRENIC Devices (Update A) 3 CVEs
- ICSA-18-270-01 Emerson AMS Device Manager 2 CVEs
- ICSA-18-270-02 Fuji Electric Alpha5 Smart Loader (Update A) 2 CVEs