Week 52, 2018
24–30 December 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 4.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-20247 In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree structure using the…EPSS 54%
-
Unscored
CVE-2018-7836 An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and exe…EPSS 32%
-
Unscored
CVE-2018-19616 An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access contr…EPSS 30%
- High 8.8 EPSS 19%
-
Unscored
CVE-2018-11741 NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=#####&GOTO(8) URIs.EPSS 18%
-
Unscored
CVE-2018-11742 NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.EPSS 14%
-
Unscored
CVE-2018-20463 An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://fil…EPSS 13%
-
Unscored
CVE-2018-20608 imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.EPSS 12%
Advisories
- DLA-1621-1 c3p0 - security update 1 CVEs