Week 6, 2019
4–10 February 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-18362 ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya …EPSS 87%
-
Critical 10.0
CVE-2018-3991 An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500. A specially crafte…EPSS 34%
-
Critical 9.8
CVE-2018-20753 Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all m…EPSS 30%
- Critical 9.8 EPSS 13%
-
Critical 9.1
CVE-2018-4056 An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially…EPSS 3%
-
Critical 9.0
CVE-2019-4008 API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files.…EPSS 2.3%
- Critical 9.1 EPSS 1.8%
- Critical 9.8 EPSS 1.7%
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2018-20250 In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When…EPSS 96%
-
Unscored
CVE-2018-11803 Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits t…EPSS 58%
-
Unscored
CVE-2018-18990 LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerab…EPSS 39%
-
Unscored
CVE-2018-20251 In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNA…EPSS 31%
- High 8.8 EPSS 20%
-
High 7.1
CVE-2019-3822 libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth…EPSS 13%
-
Unscored
CVE-2018-18500 A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being fre…EPSS 13%
-
Unscored
CVE-2019-7580 ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of…EPSS 9.9%
Advisories
- SUSE / openSUSE Security Updates 24
- Debian Security (DSA / DLA) 15
- Ubuntu Security Notices (USN) 12
- BSI CERT-Bund (WID) 7
- CISA ICS & IT advisories 42 critical
- Oracle Linux Security Advisories (ELSA) 3
- ICSA-19-036-05 Kunbus PR100088 Modbus Gateway (Update B) 5 CVEs
- ICSA-19-036-01 AVEVA InduSoft Web Studio and InTouch Edge HMI 2 CVEs