Week 14, 2019
1–7 April 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 5.9%
- Critical 9.8 EPSS 4.9%
- Critical 10.0 EPSS 1.6%
- Critical 9.8 EPSS 1.6%
- Critical 9.9 EPSS 1.2%
- Critical 9.3
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-9193 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary c…EPSS 92%
-
Unscored
CVE-2019-10692 In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.EPSS 77%
- High 8.8 EPSS 71%
-
Unscored
CVE-2019-6553 A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLinx Classic where th…EPSS 66%
-
Unscored
CVE-2018-4416 Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari …EPSS 35%
-
Unscored
CVE-2018-4407 A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.EPSS 21%
-
Unscored
CVE-2019-6715 pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionC…EPSS 19%
- Medium 6.5 EPSS 17%
Advisories
- SUSE / openSUSE Security Updates 67
- Debian Security (DSA / DLA) 15
- Ubuntu Security Notices (USN) 12
- Amazon Linux Security Center (ALAS) 6
- CISA ICS & IT advisories 51 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 3
- ICSA-19-092-01 Advantech WebAccess/SCADA 3 CVEs