Week 43, 2018
22–28 October 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 39%
- Critical 9.8 EPSS 5.5%
-
Critical 9.8
CVE-2018-15751 SaltStack Salt Remote command execution and incorrect access control when using salt-apiEPSS 5%
- Critical 9.8 EPSS 1.8%
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-14665 A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unpri…EPSS 27%
-
Unscored
CVE-2018-15704 Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vuln…EPSS 22%
-
Unscored
CVE-2018-18475 Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.EPSS 20%
- High 7.8 EPSS 16%
-
Unscored
CVE-2018-18557 LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7…EPSS 15%
-
Unscored
CVE-2018-8569 A remote code execution vulnerability exists in the Yammer desktop application due to the loading of arbitrary content, aka "Yammer Desktop Application Remote …EPSS 13%
-
Unscored
CVE-2018-17445 A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.EPSS 11%
- High 7.5 EPSS 5.7%
Advisories
- SUSE / openSUSE Security Updates 522 critical
- Debian Security (DSA / DLA) 142 critical
- Ubuntu Security Notices (USN) 8
- Amazon Linux Security Center (ALAS) 51 critical
- CISA ICS & IT advisories 51 critical
- BSI CERT-Bund (WID) 5
- Oracle Linux Security Advisories (ELSA) 21 critical
- SUSE-SU-2018:3388-1 Security update for tomcat 8 CVEs
- ALAS2-2018-1097 Critical: java-1.8.0-openjdk security update (Amazon Linux 2) 7 CVEs
- ELSA-2018-3005 Critical: firefox security and bug fix update (Oracle Linux 7) 7 CVEs
- ICSA-18-296-01 Advantech WebAccess 4 CVEs
- DLA-1558-1 ruby2.1 - security update 2 CVEs
- DLA-1556-1 paramiko - security update 2 CVEs
- SUSE-SU-2018:3430-1 Security update for mercurial 1 CVEs