Week 5, 2019
28 January – 3 February 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.7%
- Critical 10.0 EPSS 1.6%
- Critical 9.8 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-17431 Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.EPSS 84%
-
Unscored
CVE-2019-0190 A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loo…EPSS 60%
-
Medium 5.9
CVE-2019-6111 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the c…EPSS 58%
-
Medium 6.8
CVE-2018-3956 An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A s…EPSS 46%
-
Unscored
CVE-2018-15517 The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbou…EPSS 44%
-
Medium 6.8
CVE-2019-6110 In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the …EPSS 25%
-
Unscored
CVE-2018-17199 In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to …EPSS 20%
-
Unscored
CVE-2018-17189 In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily…EPSS 19%
Advisories
- Debian Security (DSA / DLA) 272 critical
- SUSE / openSUSE Security Updates 11
- Oracle Linux Security Advisories (ELSA) 91 critical
- Ubuntu Security Notices (USN) 91 critical
- CISA ICS & IT advisories 71 critical
- BSI CERT-Bund (WID) 3
- ELSA-2019-0219 Critical: firefox security update (Oracle Linux 7) 3 CVEs
- ICSA-19-031-01 Schneider Electric EVLink Parking 3 CVEs
- DSA-4373-1 coturn - security update 3 CVEs
- USN-3876-1 avahi vulnerabilities 2 CVEs
- DLA-1659-1 drupal7 - security update 1 CVEs