Week 8, 2019
18–24 February 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 3.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2019-9082 ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&fun…EPSS 97%
- High 8.1 EPSS 92%
-
Unscored
CVE-2019-8943 WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary …EPSS 92%
-
Unscored
CVE-2019-8942 WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, su…EPSS 83%
- High 7.5 EPSS 72%
-
Unscored
CVE-2019-6453 mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that …EPSS 55%
-
Unscored
CVE-2019-8953 The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and hapr…EPSS 52%
-
Unscored
CVE-2019-8917 SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpB…EPSS 36%
Advisories
- SUSE / openSUSE Security Updates 282 critical
- Debian Security (DSA / DLA) 14
- Oracle Linux Security Advisories (ELSA) 6
- Ubuntu Security Notices (USN) 4
- CISA ICS & IT advisories 41 critical
- BSI CERT-Bund (WID) 2
- ICSA-19-050-04 Rockwell Automation Allen-Bradley PowerMonitor 1000 (Update A) 2 CVEs
- SUSE-SU-2019:0448-1 Security update for python-numpy 1 CVEs
- SUSE-SU-2019:0419-1 Security update for python-numpy 1 CVEs