Week 11, 2019
11–17 March 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2018-19276 OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the …EPSS 99%
- Critical 9.8 EPSS 5.8%
- Critical 9.8 EPSS 3.4%
- Critical 9.1
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2018-10093 AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.EPSS 68%
-
Unscored
CVE-2018-20323 www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands.EPSS 54%
-
Unscored
CVE-2019-9760 FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-controlled machine that sends crafted respo…EPSS 53%
-
Unscored
CVE-2018-19524 An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SDOTBGN1 devices. A l…EPSS 51%
-
Unscored
CVE-2019-9692 class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, o…EPSS 46%
-
Unscored
CVE-2018-19191 Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall par…EPSS 39%
-
Unscored
CVE-2019-9787 WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occ…EPSS 39%
-
Unscored
CVE-2019-6714 An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticate…EPSS 32%
Advisories
- SUSE / openSUSE Security Updates 191 critical
- Debian Security (DSA / DLA) 11
- Oracle Linux Security Advisories (ELSA) 8
- Ubuntu Security Notices (USN) 7
- BSI CERT-Bund (WID) 5
- CISA ICS & IT advisories 4
- Siemens ProductCERT 1
- Amazon Linux Security Center (ALAS) 1
- CERT@VDE 1
- SUSE-SU-2019:13977-1 Security update for python-numpy 1 CVEs