Week 51, 2018
17–23 December 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-1160 Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote …EPSS 86%
-
Critical 9.8
CVE-2018-19323 The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.0…EPSS 8.4%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 3.2%
- Critical 9.1 EPSS 2.2%
- Critical 10.0 EPSS 1.9%
- Critical 10.0 EPSS 1.9%
- Critical 10.0 EPSS 1.9%
- Critical 9.8 EPSS 1.8%
- Critical 9.0 EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-17246 Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could…EPSS 84%
-
Unscored
CVE-2018-1000811 bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Comma…EPSS 48%
-
High 7.5
CVE-2018-8653 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 30%
Microsoft · Internet Explorer 11 · Internet Explorer 9 · Internet Explorer 10
-
Unscored
CVE-2018-6307 LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can res…EPSS 27%
-
Unscored
CVE-2018-20173 Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.EPSS 24%
-
Unscored
CVE-2018-18556 A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo)…EPSS 15%
-
Unscored
CVE-2018-15127 LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can…EPSS 15%
-
Unscored
CVE-2018-15126 LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extension that can res…EPSS 12%
Advisories
- SUSE / openSUSE Security Updates 342 critical
- Debian Security (DSA / DLA) 111 critical
- CISA ICS & IT advisories 83 critical
- Ubuntu Security Notices (USN) 6
- Amazon Linux Security Center (ALAS) 6
- BSI CERT-Bund (WID) 5
- Oracle Linux Security Advisories (ELSA) 41 critical
- ELSA-2018-3833 Critical: firefox security update (Oracle Linux 7) 6 CVEs
- ICSA-18-352-04 3S-Smart Software Solutions GmbH CODESYS V3 Products 2 CVEs
- ICSA-18-352-01 ABB GATE-E2 2 CVEs
- SUSE-SU-2018:4217-1 Security update for netatalk 1 CVEs
- SUSE-SU-2018:4214-1 Security update for netatalk 1 CVEs
- DSA-4356-1 netatalk - security update 1 CVEs
- ICSA-18-352-03 3S-Smart Software Solutions GmbH CODESYS Control V3 Products 1 CVEs