Week 42, 2018
15–21 October 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.1
CVE-2018-10933 A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first perform…EPSS 92%
-
Critical 10.0
CVE-2018-4013 An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafte…EPSS 9.7%
-
Critical 9.8
CVE-2018-1822 IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely…EPSS 3.4%
- Critical 9.0 EPSS 3.3%
- Critical 9.6 EPSS 2.2%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.7%
- Critical 9.8 EPSS 1.5%
- Critical 9.8 EPSS 1.2%
- Critical 9.8 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-3245 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are…EPSS 94%
-
Unscored
CVE-2018-10823 An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 thr…EPSS 78%
-
Unscored
CVE-2018-18323 CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ …EPSS 71%
-
Unscored
CVE-2018-17532 Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspot…EPSS 71%
-
Unscored
CVE-2018-3191 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are…EPSS 63%
-
Unscored
CVE-2015-4632 Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote…EPSS 52%
-
Unscored
CVE-2018-10822 Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-…EPSS 39%
-
Unscored
CVE-2018-3252 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are…EPSS 30%
Advisories
- SUSE / openSUSE Security Updates 805 critical
- Debian Security (DSA / DLA) 132 critical
- Ubuntu Security Notices (USN) 61 critical
- Oracle Linux Security Advisories (ELSA) 31 critical
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 2
- CERT@VDE 1
- SUSE-SU-2018:3261-1 Security update for tomcat 7 CVEs
- ELSA-2018-2942 Critical: java-1.8.0-openjdk security update (Oracle Linux 7) 7 CVEs
- SUSE-SU-2018:2898-2 Security update for smt, yast2-smt 3 CVEs
- SUSE-SU-2018:3253-1 Security update for libssh 1 CVEs
- SUSE-SU-2018:1327-2 Security update for curl 1 CVEs
- DLA-1548-1 libssh - security update 1 CVEs
- USN-3795-1 libssh vulnerability 1 CVEs
- DSA-4322-1 libssh - security update 1 CVEs
- SUSE-SU-2018:3162-1 Security update for libssh 1 CVEs