Week 12, 2019
18–24 March 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 77%
-
Critical 9.1
CVE-2019-9948 urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist …EPSS 12%
- Critical 9.8 EPSS 3.4%
-
Critical 9.0
CVE-2018-3963 An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its c…EPSS 2.6%
- Critical 9.6 EPSS 1.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Unscored EPSS 73%
-
Medium 6.1
CVE-2019-9978 The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in t…EPSS 73%
-
Unscored
CVE-2019-6441 An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset…EPSS 54%
-
Unscored
CVE-2019-6116 In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.EPSS 42%
-
Unscored
CVE-2018-19365 The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP req…EPSS 22%
-
Unscored
CVE-2018-20525 Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.EPSS 22%
-
Unscored
CVE-2018-20556 SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id paramet…EPSS 19%
-
Unscored
CVE-2019-9649 An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal tec…EPSS 15%
Advisories
- SUSE / openSUSE Security Updates 823 critical
- Debian Security (DSA / DLA) 191 critical
- Ubuntu Security Notices (USN) 7
- Amazon Linux Security Center (ALAS) 5
- CISA ICS & IT advisories 32 critical
- Oracle Linux Security Advisories (ELSA) 31 critical
- BSI CERT-Bund (WID) 3
- CERT@VDE 1
- ELSA-2019-0622 Critical: firefox security update (Oracle Linux 7) 8 CVEs
- ICSA-19-078-02 Columbia Weather Systems MicroServer 6 CVEs
- openSUSE-SU-2019:0194-1 Security update for phpMyAdmin 2 CVEs
- openSUSE-SU-2019:0058-1 Security update for live555 2 CVEs
- ICSMA-19-080-01 Medtronic Conexus Radio Frequency Telemetry Protocol (Update C) 2 CVEs
- DLA-1718-1 sqlalchemy - security update 2 CVEs
- openSUSE-SU-2019:0232-1 Security update for build 1 CVEs