Week 4, 2019

21–27 January 2019

New CVEs: 186
Critical: 4
High: 25
Newly exploited: 0
Advisories: 51
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2019-6339 PHAR stream wrapper Arbitrary PHP code execution
Drupal · Drupal core

EPSS 36%
Critical 9.9
CVE-2019-1651 Cisco SD-WAN Solution Buffer Overflow Vulnerability
Cisco · Cisco SD-WAN Solution

EPSS 4.9%
Critical 9.8
CVE-2019-6798 phpMyAdmin SQL injection in Designer feature
EPSS 3.6%
Critical 9.8
CVE-2017-17836 Apache Airflow vulnerable to XSS
Apache Software Foundation · Apache Airflow

EPSS 3.2%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2019-1653 Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 100%
High 8.8
CVE-2019-1003000 Protection Mechanism Failure in Jenkins Script Security Plugin
Jenkins Project · Script Security Plugin

EPSS 98%
High 7.2
CVE-2019-1652 Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 96%
High 8.8
CVE-2019-1003001 Jenkins Groovy Plugin sandbox bypass vulnerability
Jenkins Project · Pipeline: Groovy Plugin

EPSS 86%
High 8.8
CVE-2019-1003002 Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability
Jenkins Project · Pipeline: Declarative Plugin

EPSS 81%
Unscored
CVE-2019-6977 gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.…
EPSS 71%
High 7.8
CVE-2019-1636 Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
Cisco · Cisco Webex Teams

EPSS 47%
Medium 4.3
CVE-2018-13374 A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server…
Fortinet · Fortinet FortiOS, fortiADC

EPSS 38%

Advisories

VDE-2019-001 PHOENIX CONTACT: Multiple Vulnerabilities in FL SWITCH 3xxx, 4xxx and 48xx 6 CVEs
ICSA-19-024-01 Advantech WebAccess/SCADA 3 CVEs