Patch days / May 2019

Microsoft Patch Tuesday — May 2019

Tuesday, 14 May 2019

Vulnerabilities: 79
Critical: 1
High: 20
Zero-days: 0
Public exploit: 3

Exploited 3

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

Critical 9.8
CVE-2019-0708 Exploited Public exploit A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the ta…
EPSS 100%
High 8.8
CVE-2019-0903 Exploited A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…
EPSS 22%
High 7.8
CVE-2019-0863 Exploited Public exploit An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vuln…
EPSS 5.2%

Public exploit code 1

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

Unscored
CVE-2019-0881 Public exploit An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege Vulnerabi…
EPSS 2.6%

All vulnerabilities 79

Critical1 Show

Critical 9.8
CVE-2019-0708 Exploited Public exploit A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the ta…
EPSS 100%

High20 Show

High 8.8
CVE-2019-0903 Exploited A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…
EPSS 22%
High 7.8
CVE-2019-0863 Exploited Public exploit An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vuln…
EPSS 5.2%
High 7.5
CVE-2019-0820 Regular Expression Denial of Service in System.Text.RegularExpressions
EPSS 5.7%
High 7.5
CVE-2019-0911 Out-of-bounds write
EPSS 9.1%
High 7.5
CVE-2019-0912 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0913 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0914 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0915 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0916 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0917 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0922 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0923 Out-of-bounds write
EPSS 9%
High 7.5
CVE-2019-0924 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0925 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0927 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0933 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0937 Out-of-bounds write
EPSS 9.2%
High 7.5
CVE-2019-0980 Denial of service in ASP.NET Core
EPSS 5%
High 7.5
CVE-2019-0981 Denial of service in ASP.NET Core
EPSS 5%
High 7.5
CVE-2019-0982 Denial of service in ASP.NET Core
EPSS 6.7%

Medium2 Show

Medium 5.5
CVE-2019-0976 NuGet Package Manager Tampering Vulnerability
EPSS 1.2%
Medium 5.4
CVE-2019-0963 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…
EPSS 1.6%

Unscored56 Show