Week 45, 2018
5–11 November 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 87%
- Critical 9.8 EPSS 71%
- Critical 9.8 EPSS 53%
- Critical 9.8 EPSS 50%
- Critical 9.8 EPSS 4%
-
Critical 9.6
CVE-2018-18590 MFSBGN03829 rev.1 - Micro Focus Operation Bridge Containerized Suite, Remote Code ExecutionEPSS 1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-18820 A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can s…EPSS 49%
-
Medium 5.3
CVE-2018-16843 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects…EPSS 48%
-
Unscored
CVE-2018-18980 An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML…EPSS 25%
-
Unscored
CVE-2018-18949 Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.EPSS 24%
-
Unscored
CVE-2018-19126 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.EPSS 23%
-
Unscored
CVE-2018-19127 A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, le…EPSS 21%
-
Unscored
CVE-2018-19052 An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory abo…EPSS 14%
-
Medium 5.3
CVE-2018-16844 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx co…EPSS 13%
Advisories
- Oracle Linux Security Advisories (ELSA) 362 critical
- SUSE / openSUSE Security Updates 21
- Debian Security (DSA / DLA) 14
- Ubuntu Security Notices (USN) 92 critical
- Amazon Linux Security Center (ALAS) 5
- BSI CERT-Bund (WID) 41 critical
- CISA ICS & IT advisories 4
- ELSA-2018-3521 Critical: java-11-openjdk security update (Oracle Linux 7) 7 CVEs
- USN-3808-1 ruby1.9.1, ruby2.0, ruby2.3, ruby2.5 vulnerabilities 2 CVEs
- ELSA-2018-3347 Critical: python-paramiko security update (Oracle Linux 7) 1 CVEs
- WID-SEC-2023-2511 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes 1 CVEs
- USN-3810-1 ppp vulnerability 1 CVEs