Week 50, 2018
10–16 December 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-20062 An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter par…EPSS 100%
- Critical 9.8 EPSS 98%
- Critical 9.8 EPSS 4.5%
- Critical 9.8 EPSS 3.2%
- Critical 9.8 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-8631 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 68%
Microsoft · Internet Explorer 11 · Internet Explorer 10 · Internet Explorer 9
- High 7.5 EPSS 66%
- High 7.5 EPSS 62%
-
Unscored
CVE-2018-8619 A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions…EPSS 45%
Microsoft · Internet Explorer 11 · Internet Explorer 9 · Internet Explorer 10
-
Unscored
CVE-2018-8625 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 44%
Microsoft · Internet Explorer 11 · Internet Explorer 10 · Internet Explorer 9
-
High 8.8
CVE-2018-17480 Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a rem…EPSS 36%
-
Unscored
CVE-2018-8587 A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co…EPSS 29%
-
Unscored
CVE-2018-20148 In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. …EPSS 27%
Advisories
- SUSE / openSUSE Security Updates 34
- Debian Security (DSA / DLA) 8
- CISA ICS & IT advisories 72 critical
- Ubuntu Security Notices (USN) 6
- Amazon Linux Security Center (ALAS) 4
- Oracle Linux Security Advisories (ELSA) 3
- BSI CERT-Bund (WID) 3
- ICSA-18-345-02 ICSA-18-345-02 Siemens SINUMERIK Controllers (Update A) 10 CVEs
- ICSA-18-352-05 Siemens TIM 1531 IRC Modules 1 CVEs