Week 13, 2019
25–31 March 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-3396 The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed vers…EPSS 100%
-
Critical 9.8
CVE-2019-7609 Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion applicatio…EPSS 95%
-
Critical 9.8
CVE-2019-10068 An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security…EPSS 95%
- Critical 9.8 EPSS 89%
- Critical 10.0 EPSS 5%
- Critical 9.8 EPSS 4.2%
- Critical 9.8 EPSS 3.4%
- Critical 9.8 EPSS 3.4%
-
Critical 9.8
CVE-2019-10648 Improper Input Validation in net.sf.robocode:robocode.host allows for external service interactionEPSS 2.3%
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 99%
-
Unscored
CVE-2019-9053 An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL i…EPSS 69%
-
High 7.8
CVE-2018-16858 It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bu…EPSS 67%
-
Medium 5.3
CVE-2019-3829 A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any …EPSS 59%
-
Unscored
CVE-2019-9164 Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.EPSS 46%
-
Unscored
CVE-2019-10662 Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-ba…EPSS 44%
-
Unscored
CVE-2019-10663 Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup AP…EPSS 28%
-
Unscored
CVE-2019-9202 Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.EPSS 24%
Advisories
- SUSE / openSUSE Security Updates 52
- Debian Security (DSA / DLA) 20
- Ubuntu Security Notices (USN) 10
- Oracle Linux Security Advisories (ELSA) 61 critical
- BSI CERT-Bund (WID) 5
- CISA ICS & IT advisories 31 critical
- CERT@VDE 2
- ELSA-2019-0671 Critical: firefox security update (Oracle Linux 7) 2 CVEs
- ICSA-19-085-02 PHOENIX CONTACT RAD-80211-XD 1 CVEs