Week 40, 2018
1–7 October 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 3.5%
- Critical 9.1 EPSS 2%
- Critical 9.8 EPSS 2%
- Critical 9.1 EPSS 1.8%
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 4.3 EPSS 98%
-
Unscored
CVE-2018-17456 Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code executio…EPSS 97%
- Unscored EPSS 86%
-
Unscored
CVE-2018-17552 SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.EPSS 84%
-
Unscored
CVE-2018-17553 An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated at…EPSS 79%
-
Unscored
CVE-2012-6710 ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to …EPSS 25%
-
Unscored
CVE-2018-17408 Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file th…EPSS 19%
-
Unscored
CVE-2018-0472 Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service VulnerabilityEPSS 16%
Advisories
- SUSE / openSUSE Security Updates 25
- Debian Security (DSA / DLA) 15
- Ubuntu Security Notices (USN) 14
- CISA ICS & IT advisories 61 critical
- BSI CERT-Bund (WID) 5
- ICSA-18-275-03 Entes EMG 12 2 CVEs