Week 1, 2019
31 December 2018 – 6 January 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 13%
-
Critical 9.8
CVE-2018-19362 com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted DataEPSS 11%
-
Critical 9.8
CVE-2018-19360 Deserialization of Untrusted Data in jackson-databind due to polymorphic deserializationEPSS 11%
- Critical 9.8 EPSS 11%
- Critical 10.0 EPSS 10%
- Critical 9.8 EPSS 9.7%
- Critical 9.8 EPSS 7.5%
- Critical 9.8 EPSS 2.8%
-
Critical 9.0
CVE-2018-4012 An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bc_http_read_header incorr…EPSS 2.5%
-
Critical 9.8
CVE-2018-6331 Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code …EPSS 2.5%
- Critical 9.8 EPSS 2.3%
-
Critical 9.8
CVE-2018-6334 Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used t…EPSS 1.9%
- Critical 9.8 EPSS 1.7%
-
Critical 9.8
CVE-2018-18602 The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring.EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-18264 Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.EPSS 70%
-
Unscored
CVE-2018-19862 Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request. NOTE: this product is discontinu…EPSS 13%
-
Unscored
CVE-2018-19861 Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request. NOTE: this product is discontinu…EPSS 13%
-
Unscored
CVE-2019-5009 Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size…EPSS 9.9%
- Medium 6.5 EPSS 8.8%
-
Unscored
CVE-2018-20658 The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted XRMD command.EPSS 8.5%
-
Unscored
CVE-2018-20664 Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.EPSS 8.1%
-
Unscored
CVE-2018-17191 Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn scr…EPSS 7.8%
Advisories
- SUSE / openSUSE Security Updates 10
- Debian Security (DSA / DLA) 8
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 31 critical
- Oracle Linux Security Advisories (ELSA) 3
- ICSA-19-003-01 Schneider Electric Pro-face GP-Pro EX 1 CVEs