Week 3, 2019
14–20 January 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 27%
-
Critical 9.8
CVE-2019-0006 Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configurationEPSS 5.3%
- Critical 9.8 EPSS 4.1%
-
Critical 9.8
CVE-2017-6925 Drupal Entity access bypass for entities that do not have UUIDs or have protected revisionsEPSS 3%
-
Critical 9.0
CVE-2018-1969 IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's…EPSS 1.7%
- Critical 9.3 EPSS 1.7%
- Critical 10.0 EPSS 1.6%
-
Critical 10.0
CVE-2019-0022 Juniper ATP: Two hard coded credentials sharing the same password give an attacker the ability to take control of any installation of the software.EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2018-15982 Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary c…EPSS 90%
-
Unscored
CVE-2018-16042 Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.…EPSS 82%
- Medium 5.3 EPSS 73%
-
Unscored
CVE-2019-6443 An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in nt…EPSS 67%
-
Unscored
CVE-2019-6447 The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP por…EPSS 64%
- High 7.5 EPSS 60%
-
Unscored
CVE-2019-6444 An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is deref…EPSS 46%
- High 7.5 EPSS 28%
Advisories
- SUSE / openSUSE Security Updates 17
- Ubuntu Security Notices (USN) 7
- Debian Security (DSA / DLA) 61 critical
- Oracle Linux Security Advisories (ELSA) 4
- CISA ICS & IT advisories 4
- BSI CERT-Bund (WID) 2
- DSA-4370-1 drupal7 - security update 2 CVEs