Week 9, 2019
25 February – 3 March 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 97%
-
Critical 9.8
CVE-2019-1663 Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution VulnerabilityEPSS 96%
Cisco · RV130W Wireless-N Multifunction VPN Router · RV110W Wireless-N VPN Firewall · RV215W Wireless-N VPN Router
-
Critical 9.8
CVE-2019-9201 Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrate…EPSS 3.2%
- Critical 9.8 EPSS 2.8%
- Critical 9.8 EPSS 2.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-9122 An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntp_server parameter in an ntp_…EPSS 24%
-
Medium 5.3
CVE-2019-4061 IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associ…EPSS 23%
- Unscored EPSS 17%
-
High 7.8
CVE-2019-1674 Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection VulnerabilityEPSS 9.8%
Cisco · Cisco Webex Meetings Desktop App · Cisco Webex Productivity Tools
-
Unscored
CVE-2018-18492 A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This resul…EPSS 9.6%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
Unscored
CVE-2019-9184 SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option…EPSS 9%
-
Unscored
CVE-2018-20796 In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(…EPSS 5.8%
-
Unscored
CVE-2018-20793 tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass, th…EPSS 5%
Advisories
- Debian Security (DSA / DLA) 22
- SUSE / openSUSE Security Updates 19
- Ubuntu Security Notices (USN) 8
- BSI CERT-Bund (WID) 41 critical
- Oracle Linux Security Advisories (ELSA) 2
- CISA ICS & IT advisories 21 critical
- ICSA-19-057-01 Moxa IKS, EDS (Update A) 10 CVEs
- WID-SEC-2023-0531 IBM SAN Volume Controller: Mehrere Schwachstellen 9 CVEs