Week 47, 2018
19–25 November 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-19410 PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote…EPSS 98%
- Critical 9.8 EPSS 8.8%
- Critical 9.8 EPSS 3.5%
-
Critical 9.8
CVE-2018-9209 FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerabilityEPSS 1.8%
- Critical 9.1 EPSS 1.7%
- Critical 9.9 EPSS 1.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-19518 University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap func…EPSS 96%
- High 7.2 EPSS 65%
- High 7.5 EPSS 33%
-
Unscored
CVE-2018-19423 Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.EPSS 18%
-
Unscored
CVE-2018-19475 psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked w…EPSS 9.5%
-
Unscored
CVE-2018-18865 The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials Disclosure.EPSS 8%
-
Unscored
CVE-2018-19409 An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.EPSS 7.8%
-
Unscored
CVE-2018-16224 Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted T…EPSS 6.6%
Advisories
- SUSE / openSUSE Security Updates 265 critical
- Debian Security (DSA / DLA) 222 critical
- Ubuntu Security Notices (USN) 3
- CISA ICS & IT advisories 2
- BSI CERT-Bund (WID) 1
- Oracle Linux Security Advisories (ELSA) 1
- SUSE-SU-2018:3862-1 Security update for salt 2 CVEs
- SUSE-SU-2018:3815-1 Security update for salt 2 CVEs
- SUSE-SU-2018:3816-1 Security update for py26-compat-salt 2 CVEs
- SUSE-SU-2018:3813-1 Security update for salt 2 CVEs
- SUSE-SU-2018:3811-1 Security update for SUSE Manager Server 3.1 2 CVEs
- DSA-4343-1 liblivemedia - security update 1 CVEs
- DLA-1582-1 liblivemedia - security update 1 CVEs