Week 48, 2018
26 November – 2 December 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.4 EPSS 3.7%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-18982 NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing …EPSS 63%
-
High 7.5
CVE-2018-3949 An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a dire…EPSS 53%
-
Unscored
CVE-2018-12122 Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by…EPSS 41%
-
Unscored
CVE-2018-13358 System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter.EPSS 25%
-
Unscored
CVE-2018-16130 System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL para…EPSS 24%
-
Unscored
CVE-2018-13023 System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL p…EPSS 24%
-
Unscored
CVE-2018-13324 Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header.EPSS 23%
-
High 7.5
CVE-2018-3948 An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause…EPSS 23%
Advisories
- SUSE / openSUSE Security Updates 211 critical
- Debian Security (DSA / DLA) 13
- Ubuntu Security Notices (USN) 9
- Oracle Linux Security Advisories (ELSA) 7
- CISA ICS & IT advisories 4
- BSI CERT-Bund (WID) 1
- SUSE-SU-2018:3011-1 Security update for tomcat 4 CVEs