Week 49, 2018
3–9 December 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 87%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.2
CVE-2018-4021 An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta…EPSS 70%
-
High 7.5
CVE-2018-16855 An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while co…EPSS 59%
-
High 7.2
CVE-2018-4020 An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta…EPSS 49%
-
High 7.2
CVE-2018-4019 An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta…EPSS 49%
-
Unscored
CVE-2018-7114 HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code execution. This probl…EPSS 33%
Hewlett Packard Enterprise · HPE Intelligent Management Center (iMC)
-
Unscored
CVE-2018-14699 System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system…EPSS 29%
-
Unscored
CVE-2018-19660 An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Buil…EPSS 29%
-
Unscored
CVE-2018-14707 Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary l…EPSS 28%
Advisories
- SUSE / openSUSE Security Updates 33
- Ubuntu Security Notices (USN) 8
- Amazon Linux Security Center (ALAS) 61 critical
- Debian Security (DSA / DLA) 4
- CISA ICS & IT advisories 4
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 3
- ALAS2-2018-1111 Critical: java-1.7.0-openjdk security update (Amazon Linux 2) 6 CVEs