Week 7, 2019
11–17 February 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 2.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-5736 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host roo…EPSS 98%
-
High 7.5
CVE-2019-8394 Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.EPSS 63%
-
Unscored
CVE-2019-8341 An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a t…EPSS 44%
-
Unscored
CVE-2017-0938 Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.EPSS 21%
-
Unscored
CVE-2019-6543 AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is …EPSS 17%
ICS-CERT · AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update
-
Unscored
CVE-2019-6974 In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-a…EPSS 17%
-
Unscored
CVE-2019-6545 AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unaut…EPSS 14%
ICS-CERT · AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update
- Unscored EPSS 10%
Advisories
- SUSE / openSUSE Security Updates 303 critical
- Debian Security (DSA / DLA) 161 critical
- Amazon Linux Security Center (ALAS) 71 critical
- Ubuntu Security Notices (USN) 5
- CISA ICS & IT advisories 51 critical
- Oracle Linux Security Advisories (ELSA) 4
- BSI CERT-Bund (WID) 1
- ALAS2-2019-1157 Critical: thunderbird security update (Amazon Linux 2) 4 CVEs
- ICSA-19-043-03 WIBU SYSTEMS AG WibuKey Digital Rights Management (Update D) 3 CVEs
- DLA-1671-1 coturn - security update 3 CVEs
- SUSE-SU-2019:0418-1 Security update for python-numpy 1 CVEs
- SUSE-SU-2019:0387-1 Security update for build 1 CVEs
- SUSE-SU-2019:13951-1 Security update for python-numpy 1 CVEs