Week 2, 2019
7–13 January 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 7.3%
- Critical 9.8 EPSS 2.9%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 83%
- High 7.5 EPSS 80%
-
Unscored
CVE-2018-16167 LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.EPSS 75%
-
Unscored
CVE-2019-0547 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP Clie…EPSS 71%
- High 7.5 EPSS 69%
-
High 8.8
CVE-2019-0541 A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerabili…EPSS 53%
Microsoft · Microsoft Office · Internet Explorer 11 · Internet Explorer 9
-
Unscored
CVE-2019-0572 An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 25%
Microsoft · Windows Server 2019 · Windows Server 2016 · Windows 10
-
Unscored
CVE-2019-5893 Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.EPSS 25%
Advisories
- SUSE / openSUSE Security Updates 151 critical
- CISA ICS & IT advisories 102 critical
- Debian Security (DSA / DLA) 9
- Amazon Linux Security Center (ALAS) 8
- Ubuntu Security Notices (USN) 6
- BSI CERT-Bund (WID) 6
- ICSA-19-008-02 Schneider Electric IIoT Monitor (Update A) 4 CVEs
- ICSA-19-043-06 ICSA-19-043-06 Siemens CP1604 and CP1616 (Update A) 3 CVEs
- SUSE-SU-2018:2204-2 Security update for libsoup 2 CVEs